UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

UEFI bootkit BlackX exploits Microsoft’s lack of clarity around Secure Boot protections. UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame. Text settings Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only Learn more Minimize to nav In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems.

With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defenses were operational. Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates.

The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches.

UEFI bootkit refresher Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order.