The BlackX UEFI bootkit has infected Windows machines that had every available update installed, according to Kaspersky, the security firm that discovered the campaign. The infections expose a gap between installing Microsoft’s patches and actually activating the protections those patches were meant to deliver.
What BlackX does and why it matters
BlackX is a bootkit, meaning it runs before Windows finishes loading. It targets UEFI, the firmware that starts a computer, initializes hardware, and then hands control to the operating system. UEFI also provides Secure Boot, which checks digital signatures on each piece of boot software so that unauthorized code cannot run in place of legitimate code.
The bootkit takes advantage of a logic flaw in the Windows boot manager known as Baton Drop, tracked as CVE-2022-21894. That flaw allows an attacker to get around Secure Boot. Under some conditions, it can also be used to extract BitLocker encryption keys. Microsoft fixed the flaw in 2022.
Running this early gives attackers a valuable position. Malicious drivers can be loaded into the Windows kernel before many operating-system and security defenses are active. Detection is difficult without specialized tools, and an infected boot partition can survive a reinstallation of Windows. Attackers still need to compromise a device first, but the payoff is stealth, persistence, and deep control over the system.
The patch that did not finish the job
Fixing the underlying vulnerability was not enough. The certificate used to sign older, vulnerable boot managers remained trusted. In 2023, malware called BlackLotus became the first publicly documented in-the-wild UEFI bootkit to bypass Secure Boot on fully updated Windows 11 systems by exploiting that gap.
Microsoft responded with a multi-step mitigation. In May 2023, its updates added a new signing certificate, Windows UEFI CA 2023, to Secure Boot’s trusted database. In 2024, it provided a way to add the older certificate, Windows Production PCA 2011, to the forbidden-signatures database.
That second step was the one that could stop older boot managers signed under the 2011 certificate from running. But the update did not revoke trust by itself. Microsoft held back from enforcing the revocation out of concern that millions of devices could become unbootable if they had not received the necessary updates. As a result, administrators had to take an extra manual step to activate the protection.
Kaspersky said that requirement is easy to miss. System administrators typically take no further action after a patch installs unless something fails, the firm noted. The instructions for activating the revocation are buried on Microsoft’s website. Kaspersky assessed that an average IT administrator would find them hard to notice.
Microsoft's guidance and what it leaves out
A Microsoft representative said by email that the company is directing customers to a Knowledge Base post published two weeks ago. That post does not warn that the patches released so far do nothing to protect against Baton Drop attacks, according to the source report. Nor does it state that most administrators must perform an additional action described in a 2023 Knowledge Base article after installing the patches. The status for home Windows users is not clear.
Kaspersky believes the threat actor behind BlackX counted on few organizations realizing the manual activation mattered. The firm said it appears the attackers invested time in learning how BlackLotus works and building a copycat.
The balancing act behind Secure Boot
The BlackX infections illustrate the trade-off Microsoft faces. Revoking the old certificate before the new one is in place can leave a machine unable to boot. Leaving the old certificate trusted for years makes successful exploitation close to inevitable.
The middle path, according to the source report, would be for Microsoft to state plainly what risk remains when the 2011 certificate is not manually revoked. The recent Knowledge Base article would have been a natural place to do so.
For organizations, the lesson is that a patch can be installed without its protection being switched on. For Microsoft, the episode raises a question that goes beyond code: whether its guidance makes the remaining step impossible to overlook.
