Ethical Hacking News
BlackX, a new UEFI bootkit, has infected fully patched Windows machines, highlighting the vulnerabilities of Microsoft's approach to patching and securing its operating systems. The incident underscores the difficult balancing act Microsoft must perform in order to ensure the security of its customers' devices.
The recent discovery of UEFI bootkit BlackX highlights vulnerabilities in Microsoft's approach to patching and securing its operating systems.BlackLotus, a malware tracked as UEFI bootkit in 2023, was the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems.Microsoft patched the underlying bootloader vulnerability that BlackLotus exploited in 2022, but didn't revoke trust in older vulnerable boot managers, leaving them still vulnerable to attack.The lack of clarity around Secure Boot protections allows attackers to exploit this vulnerability, making patches alone not enough for complete protection.Microsoft's approach leaves administrators with an additional action to take after installing patches, which has enabled threat actors to create a copycat of the BlackLotus bootkit.The discovery of BlackX highlights the need for Microsoft to be more explicit about the risks of not manually revoking the 2011 certificate.
The recent discovery of the UEFI bootkit BlackX has brought to light the vulnerabilities of Microsoft's approach to patching and securing its operating systems. Despite Microsoft's efforts to address the issue, the company's lack of clarity around Secure Boot protections has left many systems exposed to attack.
In 2023, the malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. This was a major milestone, as it transformed bootkits that bypassed Secure Boot from a theoretical threat to a real one. However, Microsoft had already patched the underlying bootloader vulnerability that BlackLotus exploited in 2022.
Despite this, the company's May 2023 patch batch included security updates to prevent attackers from loading older vulnerable boot managers. However, these updates did not revoke trust in the older vulnerable boot managers, leaving them still vulnerable to attack. This decision was made to avoid rendering potentially millions of devices unbootable if they hadn't received the necessary updates.
The lack of clarity around Secure Boot protections has allowed attackers to exploit this vulnerability, creating a situation where patches alone do not provide complete protection. As a result, the BlackX incident underscores the difficult balancing act Microsoft must perform. Revoke the key before the new one has been installed, and a machine becomes little more than an expensive paperweight. Allow the old patch to be trusted for four years and counting, and successful exploitation is almost inevitable.
In this situation, Microsoft leaves out that after installing the patches, most administrators must take an additional action described in this 2023 Knowledge Base article. This omission has allowed threat actors to understand the importance of manually activating the Baton Drop patch and has enabled them to create a copycat of the BlackLotus bootkit.
The discovery of BlackX highlights the need for Microsoft to be more explicit about the risks that result when the 2011 certificate isn't manually revoked. Until then, the company's approach to patching and securing its operating systems will continue to be vulnerable to attack.
Related Information:
https://www.ethicalhackingnews.com/articles/When-Patching-Isnt-Protecting-The-UEFI-Bootkit-BlackX-and-Microsofts-Lack-of-Clarity-ehn.shtml
https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/
https://blog.gridinsoft.com/blackx-bootkit-patched-windows-secure-boot/
Published: Tue Nov 3 10:50:26 2026 by llama3.2 3B Q4_K_M
