Key facts
- Kaspersky said the organizations infected by BlackX had installed all Microsoft patches issued since 2022.
- BlackX exploits Baton Drop, a logic flaw in the Windows boot manager tracked as CVE-2022-21894.
- Microsoft's 2024 mitigation added a way to forbid the older Windows Production PCA 2011 certificate but did not enforce the revocation.
- A Kaspersky researcher said patch instructions are buried deep on the Microsoft website and hard for an average IT administrator to notice.
- A Microsoft representative said the company advises customers to follow a Knowledge Base post published two weeks ago.
- Kaspersky said the threat actor behind BlackX likely studied BlackLotus and built a copycat bootkit.
A UEFI bootkit tracked as BlackX infected Windows machines that had installed every Microsoft patch issued to close the Baton Drop flaw, security firm Kaspersky reported. The flaw, tracked as CVE-2022-21894, is a logic error in the Windows boot manager that lets attackers bypass Secure Boot, the firmware feature that verifies digital signatures of boot software before it runs.
Microsoft fixed the underlying vulnerability in 2022 but did not revoke trust in the certificate used to sign older vulnerable boot managers. Malware tracked as BlackLotus exploited that gap in 2023, becoming the first publicly documented in-the-wild UEFI bootkit to bypass Secure Boot on fully updated Windows 11 systems. Microsoft then began a multi-year mitigation, adding the Windows UEFI CA 2023 certificate to Secure Boot's trusted database in May 2023 and, in 2024, providing a way to add the older Windows Production PCA 2011 certificate to the forbidden-signatures database.
That second step did not enforce the revocation, because Microsoft feared rendering potentially millions of devices unbootable if they had not received the necessary updates. Administrators must take an additional manual step described in a 2023 Knowledge Base article, and Kaspersky said those instructions are buried deep on the Microsoft website and hard for an average IT administrator to notice.
A Microsoft representative said in an email that the company is advising customers to follow guidance in a Knowledge Base post published two weeks ago. That post does not warn that the patches released to date do nothing to protect customers from Baton Drop attacks, and it is not clear from the 2023 article what the status is for home Windows users.
Kaspersky said the threat actor behind BlackX likely took into account that few organizations realized the importance of manually activating the Baton Drop patch, and decided to invest time in understanding BlackLotus and creating a copycat. UEFI bootkits run before most operating system and security defenses load, can be hard to detect without specialized tools and may survive an OS reinstallation if the infected boot partition remains intact.