New UEFI bootkit BlackX infects fully patched Windows machines

Security researchers have discovered a new UEFI bootkit dubbed BlackX that successfully infected fully updated Windows computers. The malware exploits lingering confusion around Secure Boot protections, a vulnerability class previously highlighted by the notorious BlackLotus bootkit in 2023.

• BlackX bypasses Secure Boot protections on fully updated and patched Windows 11 systems.
• The malware exploits the Baton Drop logic flaw (CVE-2022-21894) to execute malicious code early in the boot process.
• The primary reason for successful infection is that patches require manual post-installation steps that most administrators overlook.

The Mechanics of Baton Drop and UEFI Vulnerabilities

Unified Extensible Firmware Interface (UEFI) is the foundational firmware that runs immediately upon powering on a computer, initializing hardware and preparing the operating system to load. Secure Boot acts as a critical trust-chain mechanism, verifying digital signatures of boot software to block unauthorized execution.

Both BlackLotus and BlackX exploit Baton Drop, a logic flaw in the Windows boot manager tracked as CVE-2022-21894. Discovered initially in 2022, this vulnerability allows attackers to bypass Secure Boot entirely and load malicious drivers into the Windows kernel before standard operating system defenses and security tools become operational.

Microsoft's Patching Dilemma and Hidden Steps

Microsoft addressed the underlying vulnerability in 2022 and subsequently issued updates in 2023 and 2024 to add new certificates and introduce mechanisms to revoke trust in older boot managers. However, Microsoft refrained from immediately enforcing the complete revocation of older certificates due to fears of rendering millions of unpatched devices unbootable.

This cautious approach created a purgatory state where installing the patches alone provided incomplete protection. To fully mitigate the risk, system administrators were required to perform an additional manual configuration step—instructions for which were buried deep within Microsoft knowledge base documentation.

Implications for System Administrators and Business

As researchers from Kaspersky pointed out, threat actors behind BlackX anticipated that very few organizations would realize the necessity of manually activating the Baton Drop patch steps. Standard IT administration practices typically assume that installing updates via normal update channels is sufficient without further manual intervention.

The BlackX incident underscores the ongoing balancing act software giants must maintain between robust security enforcement and system stability. Revoking keys prematurely risks bricking millions of consumer devices, while delaying enforcement leaves a wide window for sophisticated bootkits to exploit administrative oversights.