BlackLotus Malware Infects Fully Patched Windows Machines

Malware tracked as BlackLotus has been found infecting fully patched Windows machines, raising questions about Microsoft's role in preventing such attacks. The malware, a type of UEFI bootkit, was first publicly documented in 2023 and was capable of bypassing Secure Boot on updated Windows 11 systems.

The vulnerability exploited by the BlackLotus malware was already patched by Microsoft in 2022. However, the company issued additional updates in 2023 and 2024 to further address the issue. These updates included a new certificate that no longer trusted vulnerable boot managers, as well as a way to revoke trust in digital certificates used to sign older Windows boot managers.

Despite installing all these patches, organizations affected by the BlackX malware still fell victim to the attack. This raises concerns about the effectiveness of Microsoft's patching process and whether more needs to be done to protect users from such threats.

UEFI, or Unified Extensible Firmware Interface, is firmware that runs immediately after a computer is turned on, with one of its main jobs being to load system configuration settings and identify hardware components. It also prepares the computer to start its operating system.

In this context, UEFI malware like BlackLotus can compromise the security of a machine by running malicious code before Windows is fully loaded, potentially subverting many security defenses in the process.

Secure Boot is a crucial UEFI function designed to prevent unauthorized code from running during the boot process. It verifies the digital signatures of each piece of boot software before allowing it to execute, thereby establishing a chain of trust.

The boot manager, responsible for loading the operating system, must also be digitally signed and verified by Secure Boot. However, BlackLotus and BlackX exploit a vulnerability in this process called "Baton Drop", which allows attackers to bypass Secure Boot under certain conditions.

This vulnerability, identified as CVE-2022-21894, was discovered in 2022 and subsequently fixed by Microsoft. Nevertheless, the company did not revoke trust in the certificate used to sign older vulnerable boot managers, leaving a window of opportunity for attackers to exploit this gap.

BlackLotus and BlackX are particularly valuable to attackers because they execute early in the boot process, allowing them to load malicious drivers into the Windows kernel before many OS and security defenses are running. This enables them to maintain stealth and persistence on infected devices.

UEFI bootkits like BlackLotus can be challenging to detect without specialized tools and may survive an OS reinstallation if the infected boot partition remains intact. This makes them particularly potent in compromising device security, especially when combined with the ability to load malicious drivers into the kernel.

The discovery of BlackX has significant implications for device security, given its ability to compromise systems that have been patched against previous threats.

Microsoft's efforts to address the vulnerability began in May 2023, nearly two years after the underlying bootloader issue was first fixed. At this time, the company issued a batch of patches aimed at preventing attackers from loading older vulnerable boot managers, which had previously allowed them to bypass Secure Boot.

A key part of Microsoft's mitigation strategy involved adding new signing certificates to Secure Boot's trusted database. In 2023, Windows UEFI CA 2023 was added, and in 2024, a broader approach was implemented that provided a way to add the older certificate, Windows Production PCA 2011, to the forbidden-signatures database.

This move did not immediately revoke trust in the older vulnerable boot managers, however. Microsoft's concern was that enforcing revocations could render millions of devices unbootable if they hadn't received the necessary updates. As a result, these systems remain vulnerable to exploitation by attackers like those behind BlackX.

The fact that Microsoft's patches did not provide complete protection until now has left a window open for threats like BlackX to take advantage of the vulnerability and bypass Secure Boot protections.

System administrators are often unaware of the need to take additional steps after installing security patches on Windows machines, according to Kaspersky researchers who discovered the BlackX infections. This lack of awareness is due in part to Microsoft's patch deployment practice, which does not clearly instruct users on what actions they must take to fully protect their systems.

Microsoft has acknowledged that its customers need to follow specific guidance to activate the patches and prevent exploitation by threat actors like those behind the Baton Drop attacks. However, this critical information is buried deep within the company's Knowledge Base post, making it difficult for even experienced IT administrators to notice.

Kaspersky researchers have pointed out that Microsoft's failure to explicitly warn customers about the need to take additional action after installing patches has contributed to the vulnerability of Windows machines. Specifically, most system administrators must manually revoke the 2011 certificate and replace it with a new one in order to prevent exploitation.

This omission is particularly concerning given the fact that home Windows users may not be aware of this requirement at all. As a result, even those who have installed the latest patches may still be vulnerable to attacks like Baton Drop.

The BlackX incident highlights the challenges Microsoft faces in balancing security and usability. On one hand, revoking the old certificate too quickly can render machines unusable. On the other hand, allowing the old patch to remain trusted for an extended period creates a vulnerability that threat actors can exploit with ease.

Microsoft's failure to clearly communicate these risks has left its customers exposed to threats like BlackX, which can bypass Secure Boot protections and compromise even fully patched Windows machines.

The threat actor behind the UEFI bootkit campaign likely exploited the fact that many organizations were unaware of the importance of manually activating the Baton Drop patch.

This lack of awareness is believed to have prompted the threat actor to study BlackLotus and create a copycat version of the bootkit, allowing them to bypass Secure Boot protections and compromise even fully patched Windows machines.