Business news and discussion on TalkFuse.
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
BlackX, a UEFI bootkit that can bypass Secure Boot on fully patched Windows machines, has infected organisations despite Microsoft’s updates intended to block this attack. The infections raise questions about whether Microsoft’s protections are clear and complete, because the malware can run before many Windows security defences start.
BlackX exploits the Baton Drop flaw, CVE-2022-21894, in older Windows boot managers, as did the earlier BlackLotus bootkit. Microsoft fixed the flaw in 2022, then issued updates in 2023 and 2024 to add a newer signing certificate and enable revocation of trust in the older one. The article says the infected organisations had installed these patches; the supplied text ends before explaining how BlackX bypassed them.
In short
- BlackX bypassed Secure Boot on patched Windows machines.
- It exploits a flaw in older Windows boot managers.
- The infections raise questions about Microsoft’s mitigation updates.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Microsoft can reasonably be held responsible for making the protection effective and understandable: the organisations reportedly installed its updates, yet BlackX still infected them by exploiting a flaw in the Windows boot process. Because the bootkit runs before many Windows defences, customers may fairly expect clear guidance on whether further steps are needed and confidence that the older vulnerable boot managers are no longer trusted.
The case against
The reported facts do not establish that Microsoft’s patches failed or that the company caused the infections: the account ends before explaining how BlackX bypassed them, and installing updates may not by itself complete every required security change. The underlying flaw was fixed in 2022, with later updates adding certificate and revocation measures, so responsibility could also lie with how systems were configured, maintained, or attacked.
Explained simply
UEFI is the software that starts a computer before Windows loads. Secure Boot is designed to check that early-starting software is trusted, but a bootkit can interfere at this stage and may run before many Windows security tools are active.
BlackX is a bootkit linked to Baton Drop, a flaw in older Windows boot managers that Microsoft fixed in 2022. Microsoft later issued updates to add a newer signing certificate and revoke trust in the older one; the earlier BlackLotus bootkit also used the flaw.
The case raises questions about how the updates work and what protection they provide. Understanding the reported infections requires knowing how BlackX got past them, which the supplied account does not explain.