UEFI bootkit BlackLotus infects fully patched Windows 11 systems

In 2023 researchers documented a malware family called BlackLotus, the first publicly observed UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. By subverting the industry‑wide chain‑of‑trust mechanism, the bootkit was able to execute malicious code before the operating system and its security defenses were fully loaded.

Microsoft had already released a patch for the vulnerability exploited by BlackLotus in 2022. Subsequent updates in 2023 and 2024 added a new certificate that no longer trusted the vulnerable boot managers and introduced a method to revoke trust in the digital certificate used to sign older vulnerable Windows boot managers.

Despite these mitigations, a later variant tracked as BlackX infected organizations that had applied all of the aforementioned patches. The article notes that the infected systems had the full set of updates, prompting questions about how the bootkit succeeded despite the existing protections. A brief overview of UEFI’s role in initializing hardware and loading the OS is also provided.