BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

BlackX, an updated version of the BlackLotus bootkit, aims to subvert Microsoft Windows startup defenses and third-party security solutions. Its primary objective is to secure long-term, covert access to compromised devices, rather than serving as an initial access vector. For deployment, attackers first require administrator privileges or physical access to the target host, after which BlackX exploits the CVE-2022-21894 vulnerability, known as Baton Drop, to load malicious code before the operating system starts.

The bootkit's effectiveness stems from its ability to bypass Secure Boot on systems that have applied the relevant software patch. Kaspersky found that attackers capitalize on organizations failing to perform additional manual steps, specifically adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX). This omission allows the bootkit to exploit the Baton Drop vulnerability despite the software update, enabling vulnerable binaries to still load.

The similarity between BlackX and BlackLotus, despite the latter's source code never entering the public domain, suggests that the threat actors behind BlackX either reverse-engineered the original or acquired its source code. Kaspersky noted this is an interesting observation, as state-sponsored groups rarely borrow techniques or code directly from cybercrime actors. Following exploitation, the UEFI payload injects a malicious driver into the Windows kernel, signed with a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio.