Discover how the BlackX UEFI bootkit successfully infects fully patched Windows machines by leveraging unenabled Secure Boot mitigations linked to CVE-2022-21894 and CVE-2023-24932, and why complex manual activation steps leave systems exposed.
How the problem works
The case concerns programs that manage to run on a computer before the operating system and basic security controls have even fully booted. One such program called BlackLotus was detected in 2023, while newer infections have recently been recorded with a similar tool called BlackX.
Both programs exploit an old issue that allows system boot protection to be bypassed. Although Microsoft released patches and updates from 2022 to 2024, the organizations that fell victim had installed all relevant updates as normal.
Why updates didn't protect systems
According to Kaspersky researchers who discovered the new infections, Microsoft chose not to automatically enable the necessary bans. The company feared that an automatic activation could immobilize millions of devices worldwide, making them impossible to start.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Linux kernel vulnerability allows remote control without password
↗
As a result, system administrators must manually take additional steps to permanently close the backdoor. These instructions are hidden in the company's technical support documents, leaving most administrators unaware that a separate, manual action is required after installing the updates.
Experts believe that the creators of BlackX were aware of this very situation, investing time in creating a program that exploits the fact that most companies never complete the manual shielding of their systems.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)