A new UEFI bootkit tracked as BlackX has infected organizations that had installed all of the Microsoft patches described in the article.
BlackLotus, which in 2023 became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems, subverted the industry-wide chain-of-trust mechanism, allowing it to run malicious code before Windows was fully loaded and many security defenses were operational. BlackLotus exploited a vulnerability that Microsoft patched in 2022; the company later issued additional updates in 2023 and 2024: the first added a new certificate that no longer trusted vulnerable boot managers, and the second provided a means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers.
Despite these measures, the organizations hit by BlackX had installed all of the patches. The article, which does not detail how the infections occurred, leaves open the question of whether Microsoft bears responsibility for the breach of fully updated machines.
Analysis
Why This Matters
- The bootkit undermines trust in Secure Boot, a foundational security feature designed to prevent malicious code from running before the operating system loads.
- It demonstrates that even fully patched systems remain vulnerable to sophisticated UEFI attacks, potentially exposing sensitive data and enabling persistent compromise.
- The incident may prompt a reassessment of how the industry handles firmware-level threats and update revocation.
Background
UEFI bootkits are rare but extremely dangerous because they execute before the operating system loads, bypassing most security defenses. BlackLotus, first seen in the wild in 2023, exploited a vulnerability in Secure Boot. Microsoft issued patches in 2022, 2023, and 2024 to address the flaw and revoke trust in compromised boot managers. The emergence of BlackX, which infected systems with all these patches installed, suggests that the current update and revocation chain may have gaps.
Key Perspectives
Omitted because the source reports no positions from any party.
What to Watch
- Whether Microsoft will release additional patches or guidance specifically addressing BlackX.
- If further infections are reported, indicating the bootkit is more widespread than currently known.
- Any attribution of the bootkit to a specific threat actor, which could inform defensive priorities.
Checked
9 claims in this story checked against 1 source: 8 supported.
Show each claim
- SupportedThe headline asks how BlackX infects organizations that have installed Microsoft updates.Ars Technica - All content: “The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?”
- SupportedThe summary asks how organizations fell victim after Microsoft issued additional updates.Ars Technica - All content: “In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?”
- SupportedOrganizations infected by BlackX had installed all the patches described in the article.Ars Technica - All content: “The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches.”
- SupportedIn 2023, BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems.Ars Technica - All content: “In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems.”
- SupportedBlackLotus subverted the industry-wide chain-of-trust mechanism, enabling it to run malicious code before Windows was fully loaded and many security defenses were operational.Ars Technica - All content: “With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational.”
- SupportedBlackLotus exploited a vulnerability Microsoft had patched in 2022.Ars Technica - All content: “Microsoft had already patched the vulnerability that BlackLotus exploited in 2022.”
- SupportedMicrosoft issued additional updates in 2023 and 2024; the first added a certificate that no longer trusted vulnerable boot managers, and the second enabled revocation of trust in the certificate signing older vulnerable Windows boot managers.Ars Technica - All content: “In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers.”
- Not in the sourcesThe article does not detail how the BlackX infections occurred.Ars Technica - All content: “So how did they fall victim? UEFI bootkit refresher Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order.”
- SupportedThe article leaves open whether Microsoft bears responsibility for the infections of organizations that had installed the described patches.Ars Technica - All content: “UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?”
