BlackX bootkit slips past Secure Boot on fully patched Windows PCs

Security researchers at Kaspersky have caught a fresh UEFI bootkit, tracked as BlackX, running on Windows machines that were fully up to date. It wriggles through a logic flaw in the Windows boot manager known as Baton Drop, tracked as CVE-2022-21894, which lets attackers sidestep Secure Boot altogether. Under the right conditions, the same flaw can also be used to pull BitLocker encryption keys.

Microsoft patched Baton Drop back in 2022, so patched machines should have been safe. They weren't. The company's follow-up work — a new Windows UEFI CA 2023 signing certificate added in May 2023, then a 2024 update that gave admins the means to blacklist the older Windows Production PCA 2011 certificate — only provided the tools. Nobody flipped the switch. Revocation had to be activated manually, and Microsoft held back on enforcing it for fear of bricking millions of devices that hadn't received the necessary updates.

That gap is the whole ballgame. A Kaspersky researcher noted that administrators almost never take extra steps after installing a patch unless something fails, and said the activation instructions are buried deep on Microsoft's website where an average IT admin is unlikely to stumble across them. A Microsoft representative told Ars the company is directing customers to a Knowledge Base post published two weeks ago. According to Ars, that post never warns that the patches released so far do nothing on their own to stop Baton Drop attacks.

Bootkits earn their keep by running early. BlackX loads malicious drivers into the Windows kernel before most operating system and security defenses have even woken up, making it a nightmare to spot without specialized tooling. It can also outlast a clean Windows reinstall if the infected boot partition survives the wipe. Attackers still need to compromise a device first, but what they get in return is stealth, persistence and deep control.

This isn't the first time. BlackLotus made headlines in 2023 as the first publicly documented in-the-wild UEFI bootkit to defeat Secure Boot on fully updated Windows 11 systems, turning what had been a theoretical threat into a real one. Kaspersky assessed that the actor behind BlackX likely studied how BlackLotus worked and built a copycat, betting that few organizations grasped the importance of manually activating the Baton Drop mitigation.

Microsoft is now stuck between two bad options: revoke the old certificate before the new one is everywhere and turn machines into expensive paperweights, or keep trusting it and make successful exploitation close to inevitable. The obvious middle path, according to Ars, would be spelling out the risk plainly when the 2011 certificate isn't manually revoked.