Kaspersky finds BlackX bootkit bypassing Secure Boot on Windows

Kaspersky has identified organisations infected with BlackX, a UEFI bootkit that can bypass Secure Boot on Windows machines despite the systems having Microsoft’s relevant updates installed. BlackX exploits CVE-2022-21894, known as “Baton Drop”, a logic flaw in the Windows boot manager. The flaw can let attackers run unauthorised boot code; in some circumstances, it can also expose BitLocker encryption keys.

By executing early in the boot process, BlackX can load a malicious driver into the Windows kernel before many operating-system and security defences are active. Bootkits can be hard to detect and may survive an operating-system reinstall if the infected boot partition remains.

Microsoft fixed the underlying flaw in 2022, but the fix did not revoke trust in older vulnerable boot managers. Updates issued from May 2023 introduced a new signing certificate, and a further mitigation in 2024 provided a way to add the old Windows Production PCA 2011 certificate to Secure Boot’s forbidden-signatures database. Kaspersky says installing updates alone is not enough: most administrators must take an additional step to activate the revocation.

The firm argues that the instructions are difficult to find and that administrators may not realise action is required. Microsoft directed customers to a Knowledge Base post published two weeks before the infections were reported; the source says that post does not warn that patches alone leave systems exposed to Baton Drop attacks.

Kaspersky believes BlackX’s operators took advantage of organisations failing to activate the mitigation, and may have studied BlackLotus to create a copycat bootkit. The source does not report how many organisations were infected or confirm that BlackX has been used beyond the identified cases.