BlackX UEFI Bootkit Hits Patched Windows Systems
Original: UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
Why This Matters
Bootkit threats that survive patching expose limits in Microsoft's Secure Boot revocation strategy.
A new UEFI bootkit called BlackX infected fully patched Windows machines by exploiting Microsoft's incomplete revocation of trust in older, vulnerable boot manager certificates tied to CVE-2022-21894.
A new UEFI bootkit named BlackX has successfully compromised organizations running fully updated Windows systems, raising questions about whether Microsoft's patch response to a years-old vulnerability was ever truly sufficient. BlackX exploits the same "Baton Drop" flaw (CVE-2022-21894) used by BlackLotus, the first publicly documented in-the-wild bootkit to bypass Secure Boot on fully patched Windows 11, which emerged in 2023. Microsoft patched the underlying vulnerability in 2022, then issued further updates in 2023 and 2024—one adding a new certificate distrusting vulnerable boot managers, another providing a mechanism to revoke trust in the signing certificate for older vulnerable managers. Affected organizations had applied all of these updates. BlackX loads malicious drivers into the Windows kernel before most OS and security defenses are active, making it exceptionally hard to detect without specialized tools. It can also survive an OS reinstall if the infected boot partition remains intact. Under certain conditions, it can also extract BitLocker encryption keys. The core problem: Microsoft never fully closed the gap between patching the vulnerability and revoking the certificates that still trusted old, exploitable boot managers—leaving a window that BlackX now actively exploits.