What happened
According to Ars Technica, a new UEFI bootkit tracked as BlackX infected Windows machines that had all security patches installed. It follows BlackLotus, the first publicly documented malware able to bypass Secure Boot on fully updated Windows 11 systems in 2023.
What is a UEFI bootkit?
UEFI (Unified Extensible Firmware Interface) is the firmware that runs immediately after a computer is turned on, initializing hardware and preparing the system to start the OS. Because bootkits live at this layer, they can run malicious code before the operating system and many security defenses are operational.
Why patches weren't enough
Microsoft patched the vulnerability BlackLotus exploited in 2022. In 2023 it added a certificate that no longer trusted vulnerable boot managers, and in 2024 it provided a way to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. Per the report, the organizations hit by BlackX had installed all of these updates, suggesting the attack exploited a weakness in the chain of trust itself rather than a known patched flaw.
Why it matters
Secure Boot is an industry-wide mechanism meant to ensure a machine only boots signed, trusted software. If that chain can be subverted, even fully patched systems may be left exposed. Ars Technica examines whether Microsoft bears responsibility.
