fenses were operational.

Microsoft had already patched the vulnerability that BlackLotus exploited in 2022. In 2023 and 2024, Microsoft issued additional updates. The first added a new certificate that no longer trusted the vulnerable boot managers. The second provided the means to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers. The organizations infected by the new bootkit, which is tracked under the name BlackX, had installed all of these patches. So how did they fall victim?

UEFI bootkit refresher

Before discussing the incident further, a brief review of BlackLotus and UEFI malware is in order. Short for Unified Extensible Firmware Interface, UEFI is firmware that runs immediately after a computer is turned on. One of its main jobs is to load system configuration settings, identify and initialize hardware components, and prepare the computer to start its OS.

Read full article

Comments

28:T431,{"@context":"https://schema.org","@type":"NewsArticle","@id":"https://nvdium.com/en/articles/420331685#article","url":"https://nvdium.com/en/articles/420331685","headline":"UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?","description":"UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.","datePublished":"2026-11-03T16:43:39.726Z","dateModified":"2026-11-04T17:05:41.933Z","mainEntityOfPage":"https://nvdium.com/en/articles/420331685","isAccessibleForFree":true,"inLanguage":"en","isPartOf":{"@i