BlackX UEFI bootkit bypasses Secure Boot on fully patched Windows via CVE-2022-21894
Researchers report the UEFI bootkit BlackX compromises fully updated Windows systems using the known Baton Drop flaw; patches alone do not revoke trust in older boot managers.
Security researchers are tracking a new UEFI bootkit called BlackX that compromises fully updated Windows systems and bypasses Secure Boot, according to IT security portals cited by ad-hoc-news.de ad-hoc-news.de
ad-hoc-news.dead-hoc-news.deOpen source ↗. The malware exploits the known vulnerability CVE-2022-21894, also called Baton Drop, and anchors itself in the system before the operating system's regular defenses start.
How BlackX gets around Secure Boot
Baton Drop is a logic flaw in the Windows boot manager. It lets attackers bypass Secure Boot and, under certain conditions, extract BitLocker keys. Microsoft patched the flaw in 2022 but did not immediately revoke the certificates for older, still vulnerable boot managers. In 2023 and 2024 the company released further updates: a new certificate that no longer trusts vulnerable boot managers, and a way to revoke trust in the certificates of older boot managers manually.
Organizations hit by BlackX had all available updates installed. Kaspersky's analysis indicates that the malware does not use a newly discovered vulnerability but relies on older components that the system still treats as trusted. Because BlackX runs at a very early stage of startup, it can load malicious kernel drivers before Windows' own defense services are active. It is also highly persistent: it survives a full reinstall of the operating system if the infected boot partition is left untouched.
In the incidents recorded so far, BlackX was not the primary entry vector. The attackers already had administrator rights on the target systems, and the bootkit was used at a later stage to secure that foothold ad-hoc-news.de
ad-hoc-news.dead-hoc-news.deOpen source ↗. The pattern follows BlackLotus from 2023, the first publicly documented UEFI bootkit able to defeat Secure Boot on fully updated Windows 11 systems in the wild.
Dispute over the mitigation steps
Kaspersky criticized the current protections. After installing the patches, administrators must take additional steps themselves to fully block older boot managers, and the instructions are hard to find on Microsoft's websites, the company said.
Microsoft pointed to a guide published two weeks earlier in its Knowledge Base. According to the report, however, that documentation contains no explicit warning that the regular software patches alone do not provide sufficient protection against attacks of the Baton Drop type.
