New UEFI bootkit infects fully patched Windows machines, raising questions for Microsoft

New UEFI bootkit infects fully patched Windows machines, raising questions for Microsoft

New UEFI bootkit infects fully patched Windows machines, raising questions for Microsoft

Researchers have found a new UEFI bootkit, dubbed BlackX, that revives the techniques of the BlackLotus bootkit to bypass Windows Secure Boot on fully patched machines. It was seen in attacks on diplomatic missions in Central Asia, and it works by exploiting a flaw known as Baton Drop after an attacker has already gained administrator access, installing custom boot keys so attacker-controlled files load at startup and injecting a signed driver into the Windows kernel. The machines were fully updated, but vulnerable boot components signed under an older 2011 certificate were still trusted because the required revocation steps had not taken effect, which is why patching alone did not stop it. Attribution to the APT41 group is only made with medium confidence and remains unconfirmed, and the report raises the question of whether Microsoft bears blame for the revocation gap.

Researchers have found a new UEFI bootkit, dubbed BlackX, that revives the techniques of the BlackLotus bootkit to bypass Windows Secure Boot on fully patched machines. It was seen in attacks on diplomatic missions in Central Asia, and it works by exploiting a flaw known as Baton Drop after an attacker has already gained administrator access, installing custom boot keys so attacker-controlled files load at startup and injecting a signed driver into the Windows kernel. The machines were fully updated, but vulnerable boot components signed under an older 2011 certificate were still trusted because the required revocation steps had not taken effect, which is why patching alone did not stop it. Attribution to the APT41 group is only made with medium confidence and remains unconfirmed, and the report raises the question of whether Microsoft bears blame for the revocation gap.

Researchers have found a new UEFI bootkit, dubbed BlackX, that revives the techniques of the BlackLotus bootkit to bypass Windows Secure Boot on fully patched machines. It was seen in attacks on diplomatic missions in Central Asia, and it works by exploiting a flaw known as Baton Drop after an attacker has already gained administrator access, installing custom boot keys so attacker-controlled files load at startup and injecting a signed driver into the Windows kernel. The machines were fully updated, but vulnerable boot components signed under an older 2011 certificate were still trusted because the required revocation steps had not taken effect, which is why patching alone did not stop it. Attribution to the APT41 group is only made with medium confidence and remains unconfirmed, and the report raises the question of whether Microsoft bears blame for the revocation gap.