BlackX Infected Fully Patched Windows Machines by Bypassing Secure Boot

What changed

BlackX infected organizations that had installed Microsoft’s patches from 2022 through 2024, yet still bypassed Windows Secure Boot. Like BlackLotus, it exploits the Baton Drop flaw in Windows boot managers, tracked as CVE-2022-21894, allowing malicious code to run before Windows security defenses are fully active.

Why it matters

This is the uncomfortable limit of “fully patched.” Microsoft fixed the underlying flaw in 2022, added the Windows UEFI CA 2023 certificate in 2023, and introduced certificate-revocation measures in 2024. But those protections depend on the boot chain trusting the right components and rejecting the old ones.

BlackX operates beneath the ordinary Windows security stack. It can load a malicious kernel-mode driver early in startup, hide from many standard defenses and potentially survive an operating-system reinstall if the infected boot partition remains untouched.

The report does not establish whether Microsoft’s design, deployment process or another route into the machines caused these infections. The clearer lesson is narrower: patching Windows did not by itself close the entire boot-level exposure. For organizations managing sensitive machines, Secure Boot is only as strong as the certificates and boot managers the device still accepts.