UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections.
In 2023, BlackLotus emerged as the first verified case of a UEFI bootkit that managed to infiltrate fully updated Windows 11 machines. The malicious software managed to bypass Secure Boot, a security feature designed to prevent unauthorized code from running during the boot process. This was accomplished by exploiting a vulnerability Microsoft had already patched in 2022.
Despite the subsequent patches issued in 2023 and 2024, organizations infected with the new bootkit known as BlackX had managed to stay protected by installing all of these updates. The incident raises questions about Microsoft's responsibility in this security breach.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
