Tech

UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 03/11/2026, 16:43:23 UTC.

Briefings

In 2023, malware BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. The malware exploited a vulnerability in Microsoft's 2022 patch, allowing it to run malicious code before Windows loaded and security defenses activated. Microsoft issued two updates in 2023 and 2024 to mitigate the issue, but infected organizations with the name BlackX installed all patches, enabling the attack. The incident occurred between 2023 and 2024, with the first documented case in 2023 and subsequent infections in 2024.

Key points

• Malware BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems in 2023.
• The malware exploited a vulnerability in Microsoft's 2022 patch, allowing it to run malicious code before Windows loaded and security defenses activated.

Context

UEFI is firmware that runs immediately after a computer is turned on, responsible for loading system configuration settings and initializing hardware components. The incident occurred in 2023 and 2024, with the first documented case in 2023 and subsequent infections in 2024. Microsoft issued two updates in 2023 and 2024 to mitigate the issue, but infected organizations with the name BlackX installed all patches, enabling the attack.

Limitations

The evidence covers only the period from 2023 to 2024. The specific number of infected organizations is not provided, only the name BlackX is mentioned. The exact number of machines infected is not specified, and the precise impact on user data or system stability is not detailed. The timeline of the vulnerability discovery and the exact date of the first infection is not fully specified.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 04/11/2026, 11:15:23 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeia7tyfwfrjyaz3xlriukkejgyqcqbwrctz7klsyzo3q6c4qeesgle