Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the National Security Agency (NSA), has released new guidance urging enterprises to verify and actively manage UEFI Secure Boot configurations to defend against persistent bootkit threats. The guidance, published as a Cybersecurity Information Sheet, highlights the risks posed by vulnerabilities such as PKFail, BlackLotus (CVE-2023-24932), and BootHole, which have enabled attackers to bypass Secure Boot protections through misconfigurations, outdated certificates, or the use of test keys. The agencies emphasize that default or neglected Secure Boot settings leave organizations exposed to firmware-level malware that can evade traditional security controls, and recommend routine audits and validation of Secure Boot variables using tools provided by the NSA.
The guidance also addresses operational challenges, noting that many enterprises still rely on outdated 2011 Microsoft certificates or have Secure Boot disabled, making them susceptible to both known and emerging threats. Additional real-world examples, such as the HybridPetya ransomware and the Bombshell UEFI shell, underscore the urgency of moving firmware security to the forefront of enterprise cybersecurity policy. Administrators are advised to confirm Secure Boot enforcement, export and analyze configuration variables, and ensure only trusted certificates and hashes are present, thereby strengthening the root of trust and mitigating supply chain and boot-time attack risks.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
In December 2025, CISA and the NSA issued guidance urging enterprises to verify, audit, and manage UEFI Secure Boot configurations to reduce exposure to bootkits and firmware-level persistence. The guidance recommends checking Secure Boot variables, avoiding misconfigurations, using NSA-provided validation tools, and incorporating these checks into enterprise and supply-chain security practices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft issued a Secure Boot playbook telling organizations to update Windows and firmware trust chains before older Secure Boot certificates begin expiring in June 2026. The guidance says Secure Boot relies on CA-backed keys in UEFI firmware to validate trusted boot components and reduce exposure to early-boot malware, and ties the certificate refresh to protections against the **BlackLotus** bootkit issue tracked as `CVE-2023-24932`. Microsoft said many PCs built since 2024 already include the newer 2023 certificates, while other systems may need monthly Windows updates, OEM BIOS/UEFI updates, or both. The company recommended a phased rollout that starts with device inventory and Secure Boot status checks, then pilots updates and validates success through registry keys and Windows Event Log indicators. Enterprise administrators reported that Windows updates alone may not be sufficient on all hardware, particularly for Lenovo and other systems that still require vendor firmware updates to ensure compatibility and load the new certificates into UEFI defaults. Practitioners also warned that automatic certificate deployment can depend on factors such as firmware readiness, telemetry, and whether devices fall into Microsoft's higher-confidence rollout groups. Operational concerns raised include multiple reboot cycles, possible **BitLocker** impacts, scheduled task triggers, and the need to update related Secure Boot-dependent assets including servers, virtual machines, PXE images, and recovery media.
Aug 5, 2026
**BlackLotus** was identified as the first publicly known UEFI bootkit seen in the wild that can bypass **UEFI Secure Boot** on fully patched Windows 11 systems by exploiting `CVE-2022-21894` and abusing legitimate Microsoft-signed boot binaries that were not added to the UEFI revocation database (`dbx`). ESET reported that the malware disables protections including **HVCI** and **BitLocker**, installs components to the EFI System Partition, enrolls an attacker-controlled Machine Owner Key, and persists through the boot process before loading a malicious kernel driver and an HTTP downloader into `winlogon.exe`. The malware also protects its files from removal and supports command-and-control tasking for payload delivery, updates, and uninstall. Microsoft said devices that have not yet received the **Secure Boot 2023 certificates** will continue to boot and receive normal updates while the certificates are rolled out over the coming months. The certificate transition is required because older **2011 Secure Boot certificates**, including the **Microsoft Corporation KEK CA 2011**, have expired, and the newer certificates are needed to keep delivering `dbx` revocation updates that block vulnerable bootloaders and bootkits such as BlackLotus. Microsoft said some systems remain delayed because of firmware incompatibilities, OEM support limits, disabled Secure Boot, Legacy BIOS mode, or unsupported Windows 11 installs, but most users do not need urgent action unless Windows reports a firmware-related Secure Boot warning.
Aug 14, 2026
Microsoft warned that Secure Boot certificates issued in 2011 are nearing expiration and that devices which do not receive the newer 2023 Secure Boot update will generally keep booting, but may stop receiving future boot-chain protections. The gap affects some older Windows systems whose OEMs no longer provide compatible BIOS or UEFI updates, as well as devices running Legacy BIOS, CSM mode, or unsupported Windows 11 configurations with Secure Boot disabled. Microsoft is reportedly skipping incompatible hardware rather than forcing updates that could cause failures, but enterprises may still face compliance, cyber-insurance, and lifecycle-management pressure because those endpoints could miss future `DBX` revocations, Windows Boot Manager updates, and mitigations for bootloader threats such as **BlackLotus**. The transition is also creating planning challenges beyond Windows. Linux distributions that rely on Microsoft-signed **shim** loaders are expected to continue booting on systems that already trust the older Microsoft UEFI CA, but older PCs that never receive firmware updates with the 2023 certificates may have trouble booting newer Linux media or releases. The issue follows Microsoft's broader effort to harden the pre-boot environment after flaws such as `CVE-2024-21302`, a Windows Secure Kernel Mode elevation-of-privilege bug that could let an administrator roll back VBS-related files to bypass protections; Microsoft responded with boot-time code integrity policies, an optional `SkuSiPolicy.p7b` revocation policy, and stronger protections on newer Windows releases. Administrators are being urged to verify Secure Boot update status, update firmware and recovery media where possible, and document compensating controls or replace hardware that cannot be brought forward.
Jun 29, 2026