BlackX bootkit bypassed Secure Boot on patched Windows systems

A newly tracked UEFI bootkit called BlackX infected organizations that had installed Microsoft's patches for the Baton Drop flaw, showing that the available updates did not by themselves stop older vulnerable Windows boot managers from running. The malware executed early in the boot process and bypassed Secure Boot, much like the earlier BlackLotus bootkit. The incident raises questions about how clearly Microsoft communicated the extra steps needed after patching.

What BlackX exploited

Both BlackLotus and BlackX exploit Baton Drop, a logic flaw in the Windows boot manager tracked as CVE-2022-21894. The flaw can allow attackers to bypass Secure Boot and, under certain conditions, extract BitLocker encryption keys. Microsoft fixed the underlying vulnerability in 2022, but it did not revoke trust in the certificate used to sign older vulnerable boot managers. BlackLotus exploited that gap and loaded a malicious kernel-mode driver, while BlackX achieved the same feat later.

Why patches did not stop it

In May 2023, Microsoft began a years-long process to close the vulnerability. That work added the Windows UEFI CA 2023 certificate to Secure Boot's trusted certificates and, in 2024, provided a way to add the older Windows Production PCA 2011 certificate to Secure Boot's forbidden-signatures database. But the second step did not revoke trust in older vulnerable boot managers, and the updates alone did not provide complete protection. Kaspersky, which discovered the BlackX infections, said administrators usually take no further action after installing patches, while the instructions for activating the mitigation were hard to notice.

Microsoft's balancing act

Microsoft said it feared rendering potentially millions of devices unbootable if revocations were enforced before necessary updates reached them. Kaspersky said the threat actor behind BlackX likely took into account that few organizations realized the importance of manually activating the Baton Drop patch. Microsoft advised customers to follow guidance in a Knowledge Base post published two weeks ago, but Kaspersky noted that the post does not warn that patches released to date do nothing to protect customers from Baton Drop attacks. Microsoft's post also does not make clear what the status is for home Windows users. The case shows the difficulty of balancing immediate protection with the risk of breaking machines that have not received the updates.

Sources: Ars Technica