BlackX UEFI bootkit bypasses Windows Secure Boot after Microsoft patches

In 2023, the BlackLotus malware became the first publicly documented UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. Despite Microsoft issuing multiple patches between 2022 and 2024 to address the underlying Baton Drop logic flaw, organizations with fully patched systems were still infected by a new bootkit tracked as BlackX. Both malware variants exploit CVE-2022-21894 to bypass Secure Boot and load malicious code before Windows fully initializes. Open article →