The BlackX bootkit has successfully compromised fully patched Windows systems by exploiting the Baton Drop vulnerability, tracked as CVE-2022-21894. This flaw allows attackers to bypass Secure Boot, a security feature designed to verify digital signatures during the startup process.
Microsoft first addressed the underlying vulnerability in 2022. Subsequent updates in 2023 introduced a new signing certificate, Windows UEFI CA 2023, while 2024 updates provided a mechanism to add the older Windows Production PCA 2011 certificate to the forbidden-signatures database.
Despite these updates, the patches do not automatically revoke trust in older boot managers. Microsoft opted against immediate enforcement to avoid rendering millions of devices unbootable. Consequently, administrators must manually perform additional steps to activate the protection.
Researchers from Kaspersky, who identified the BlackX infections, noted that these manual requirements are difficult for IT administrators to locate. Microsoft has not explicitly warned customers that standard patch installation alone fails to mitigate the Baton Drop risk.
