BlackX bootkit bypasses Windows Secure Boot

Security researchers have identified a new UEFI bootkit named BlackX that can compromise fully updated Windows systems by bypassing the Secure Boot mechanism. The malware exploits a known logic error in the Windows Boot Manager, identified as CVE-2022-21894 or “Baton Drop,” to embed itself deep within the system before standard operating system defenses can activate.

Despite Microsoft releasing patches and certificate updates in 2022, 2023, and 2024 to revoke trust in vulnerable bootloaders, BlackX remains effective. Analysis from Kaspersky suggests the malware utilizes older components that systems still recognize as trustworthy. Under certain conditions, this vulnerability may also allow attackers to extract BitLocker encryption keys.

In a related hardware-level threat, researchers have also highlighted risks involving discrete Trusted Platform Modules (dTPM). On older motherboards, attackers with physical access can use unused debug pins or bus-sniffing techniques via unencrypted LPC or SPI buses to intercept cryptographic keys. To mitigate these risks, experts recommend enforcing a pre-boot PIN or password for BitLocker encryption, especially on systems lacking processor-integrated firmware TPM (fTPM).