The UEFI bootkit BlackX has infected fully patched Windows machines by exploiting a long-standing vulnerability in the Windows boot manager that Microsoft patched in 2022 but has not fully neutralized due to delayed revocation of trust in older vulnerable bootloader certificates. Despite multiple updates, Microsoft requires administrators to manually revoke these certificates—a step often overlooked—which allowed BlackX to bypass Secure Boot protections and run malicious code early in the boot process. This incident highlights challenges in Microsoft’s patch deployment and communication, leaving systems exposed to persistent and stealthy boot-level malware.
Cybersecurity.watch
Tracking Threats, Incidents, and Vulnerabilities
Cybersecurity.watch
Tracking Threats, Incidents, and Vulnerabilities