UEFI bootkit infected fully patched Windows machines

BlackX UEFI bootkit bypassed Secure Boot on fully updated Windows 11 systems three years after the original BlackLotus discovery.

Malware tracked as BlackX infected Windows machines that had installed all Microsoft patches for the Baton Drop vulnerability CVE-2022-21894. The bootkit runs before Windows loads and can load malicious drivers into the kernel. Microsoft added a new certificate in 2023 to block older boot managers but did not revoke trust in the old certificate immediately. A 2024 patch provided a way to add the old certificate to a forbidden signatures database. Kaspersky reported the infections and noted administrators must take extra steps after installing updates to activate protections. Microsoft advises following a Knowledge Base post but does not warn that current patches do not fully protect against Baton Drop attacks.

Unconfirmed: Whether BlackX infections stem directly from Microsoft patch deployment practices