Kaspersky researchers discovered BlackX, a UEFI bootkit that bypasses Secure Boot on Windows systems that had installed Microsoft's patches, according to the source. The source says the infected organizations had installed all of the relevant updates.
The malware exploits "Baton Drop," a logic flaw in the Windows boot manager tracked as CVE-2022-21894. Microsoft fixed that flaw in 2022. The source says Microsoft did not revoke trust in the certificate used to sign older vulnerable boot managers. BlackLotus, first documented in 2023, exploited the same gap.
Microsoft added a new certificate, Windows UEFI CA 2023, in May 2023. In 2024 it introduced a mitigation that allows the older Windows Production PCA 2011 certificate to be added to Secure Boot's forbidden-signatures database. The source says this step did not revoke trust in the vulnerable boot managers by default. Microsoft did not enforce the revocation, the source says, because doing so could make millions of devices unbootable if they had not received the necessary updates.
Kaspersky's researcher wrote that the instructions for activating the protection are "buried deep" on Microsoft's website. The researcher said administrators usually take no further action after installing a patch. A Microsoft representative said the company advises customers to follow a Knowledge Base post published two weeks earlier. The source says that post does not state that the released patches fail to protect against Baton Drop attacks. The source also says Microsoft's guidance does not clearly describe the extra step administrators must take after installing the patches. The source says it is unclear what the status is for home Windows users.