BlackX bootkit Bypasses Windows Secure Boot

BlackX bootkit infections have targeted organizations running fully updated Windows systems, bypassing the hardware-level protections that were originally designed to block unauthorized software during bootup. It's a persisting vulnerability. And the discovery highlights how operating system updates handle revocation keys for system security features.

Early Execution Breaks the Chain of Trust

Unified Extensible Firmware Interface, or UEFI, initializes hardware. It's the foundational software. So it prepares a computer to load its operating system. As a key element in this initialization process, Secure Boot verifies digital signatures of boot software before execution, aiming primarily to ensure attackers can't substitute legitimate operating system components with unauthorized code.

The standard startup sequence follows a specific order:

• UEFI firmware starts immediately when the hardware powers on.
• Firmware verifies the digital signature of the boot manager stored on a dedicated drive partition.
• The boot manager initiates the loading of the main operating system kernel.
• System security tools and operating system defenses initialize.

Bootkits target the very start. First uncovered in 2022, the BlackX bootkit exploits a logic flaw in the Windows boot manager known as Baton Drop, which carries the identifier CVE-2022-21894, enabling malicious actors to bypass Secure Boot. And under specific conditions, it's used to extract BitLocker encryption keys.

By executing early in the sequence, the malware inserts malicious drivers into the Windows kernel before standard defenses activate, effectively compromising the system's core security architecture before it's even fully operational. It's a persistent threat. And because bootkits can survive complete operating system reinstallations if the infected boot partition remains intact on the hard drive, they're incredibly difficult to remove. Total nightmare.

A History of Boot Sequence Attacks

In 2023, security analysts identified BlackLotus as the first publicly documented UEFI bootkit used in real-world attacks to bypass Secure Boot on updated Windows 11 machines. It demonstrated that defeating firmware-level defenses isn't just a theoretical risk. The BlackX bootkit emerged. And it shows that attackers don't stop as they're continuing to build upon this specific evasion method.

The Update Gap Left Devices Exposed

Microsoft patched the underlying logic vulnerability in the boot manager code in 2022. But trust wasn't automatically revoked. Since older, vulnerable boot managers remained signed by a valid master key, attackers could still run an old, vulnerable boot manager on a patched system to execute their code.

In May 2023, Microsoft began rolling out updates to resolve the issue by adding a new signing certificate, Windows UEFI CA 2023, to the trusted database within Secure Boot. It's fixed. So in 2024, they've introduced a mechanism to add the previous certificate, Windows Production PCA 2011, to the database of forbidden signatures, which effectively blocks that 2011 certificate so vulnerable boot managers can't load. They're locked out.

That second step wasn't automatic. Windows systems did not enforce the key revocation by default because doing so carried a major risk of rendering millions of un-updated devices completely unbootable. So, systems remained in an intermediate state where the patch was present on the hard drive, but the vulnerable certificate remained trusted by the system hardware. It's risky.

Manual Steps Required for Full Defense

The BlackX bootkit compromised systems. But system administrators believed those systems were fully patched, unaware that it's this deployment gap that allowed the intrusion because the basic installation of Windows updates leaves the final revocation step inactive.

Security researchers at Kaspersky, the firm that discovered the BlackX infections, observed that standard administrative routines were insufficient to block the threat.

This patch creates problems. A Kaspersky researcher noted it's extremely unusual for a system administrator to take extra steps after installing an update, since admins usually don't take further action unless an installation failure occurs. But these instructions for activating the patch are buried deep on the Microsoft website, and Kaspersky assesses that they're quite hard for an average IT administrator to notice. It's difficult.

Kaspersky added context regarding the threat actors behind the current wave of compromises.

Kaspersky claims it's likely the threat actor realized few organizations bothered to manually activate the Baton Drop patch, so they simply built a copycat. They acted fast. Kaspersky believes the attackers decided to invest significant time into understanding how BlackLotus works, eventually creating a functional duplicate of this bootkit to ensure their campaign remained effective against targets. They're ready.

Microsoft's recent guidance points administrators toward a Knowledge Base entry published two weeks ago. It doesn't warn them. So complete mitigation requires administrators to manually complete the multi-step process outlined in a separate 2023 Knowledge Base article because standard updates alone can't block Baton Drop attacks.

The Continuing Risk to Enterprise Systems

The operational risk isn't resolved. And for organizations that rely solely on automated patching tools, that issue remains, while for home Windows users, public documentation can't clarify the exact status of key revocations and automated protections.

Attackers need administrative access first. So once they've gained that initial device foothold and deployed the BlackX bootkit, executing it allows threat actors to establish long-term persistence that standard security software can't easily detect or remove.

IT personnel must step in. And until administrators apply the secondary revocation steps, systems running Windows remain vulnerable to bootkits that reuse the original 2022 boot manager vulnerability, because closing it completely can't happen without manual intervention by IT personnel.