A UEFI bootkit named Black X has infected fully patched Windows machines, exploiting a logic flaw in the Windows boot manager known as "Baton Drop" (CVE-2022-21894). Despite Microsoft issuing multiple patches in 2022, 2023, and 2024 to add new trusted certificates and revoke older vulnerable certificates, the malware persists. Black X executes early in the boot process, loading malicious kernel-mode drivers before many security defenses operate.
The organizations affected had installed all relevant updates, raising questions about Microsoft's handling of Secure Boot certificate trust and revocation. The discovery marks a shift from theoretical to real-world UEFI bootkit threats targeting the firmware layer, which is difficult to detect and can survive OS reinstallation if the boot partition remains intact.
Source: Ars Technica · Summarized by HeadlinesBriefing