Loading story…
BlackLotus was identified as the first publicly known UEFI bootkit seen in the wild that can bypass UEFI Secure Boot on fully patched Windows 11 systems by exploiting CVE-2022-21894 and abusing legitimate Microsoft-signed boot binaries that were not added to the UEFI revocation database (dbx). ESET reported that the malware disables protections including HVCI and BitLocker, installs components to the EFI System Partition, enrolls an attacker-controlled Machine Owner Key, and persists through the boot process before loading a malicious kernel driver and an HTTP downloader into winlogon.exe. The malware also protects its files from removal and supports command-and-control tasking for payload delivery, updates, and uninstall.
Microsoft said devices that have not yet received the Secure Boot 2023 certificates will continue to boot and receive normal updates while the certificates are rolled out over the coming months. The certificate transition is required because older 2011 Secure Boot certificates, including the Microsoft Corporation KEK CA 2011, have expired, and the newer certificates are needed to keep delivering dbx revocation updates that block vulnerable bootloaders and bootkits such as BlackLotus. Microsoft said some systems remain delayed because of firmware incompatibilities, OEM support limits, disabled Secure Boot, Legacy BIOS mode, or unsupported Windows 11 installs, but most users do not need urgent action unless Windows reports a firmware-related Secure Boot warning.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In the July 14 KB5101650 release notes, Microsoft said Windows 10 and Windows 11 devices that had not yet received the Secure Boot 2023 certificates would continue to boot normally, receive standard updates, and get the new certificates over the coming months.
The older Microsoft Corporation KEK CA 2011 Secure Boot certificate expired on June 24, 2026 as part of Microsoft's retirement of the 2011 Secure Boot certificates.
ESET published a technical analysis describing BlackLotus as the first publicly known UEFI bootkit observed in the wild that can bypass UEFI Secure Boot on fully patched Windows 11 systems. The report detailed its persistence, Secure Boot bypass chain, payload delivery, and indicators of compromise.
A proof-of-concept exploit for CVE-2022-21894 was released in August 2022, providing public code that could be reused to bypass Secure Boot. Binarly later assessed BlackLotus as combining this public exploit with older UEFI bootkit techniques.
Microsoft patched CVE-2022-21894 in January 2022, but legitimate Microsoft-signed boot binaries affected by the flaw were not added to the UEFI revocation database (dbx), leaving them usable for Secure Boot bypass.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
windowslatest.com
Open sourcebinarly.io
Open sourcewelivesecurity.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **BlackLotus** is the first known in-the-wild UEFI bootkit able to bypass **UEFI Secure Boot** on fully updated Windows 11 and other UEFI systems. The malware abuses weaknesses tied to `CVE-2022-21894` and later `CVE-2023-24932`, allowing it to execute in the earliest software stage of boot, establish persistence across restarts, and evade normal remediation. ESET said BlackLotus had been advertised on underground forums since at least October 2022 and documented real-world samples that install a kernel driver and a user-mode payload, with follow-on capability for HTTP-based command-and-control and additional payload delivery.
Jun 29, 2026
Microsoft issued a Secure Boot playbook telling organizations to update Windows and firmware trust chains before older Secure Boot certificates begin expiring in June 2026. The guidance says Secure Boot relies on CA-backed keys in UEFI firmware to validate trusted boot components and reduce exposure to early-boot malware, and ties the certificate refresh to protections against the **BlackLotus** bootkit issue tracked as `CVE-2023-24932`. Microsoft said many PCs built since 2024 already include the newer 2023 certificates, while other systems may need monthly Windows updates, OEM BIOS/UEFI updates, or both. The company recommended a phased rollout that starts with device inventory and Secure Boot status checks, then pilots updates and validates success through registry keys and Windows Event Log indicators. Enterprise administrators reported that Windows updates alone may not be sufficient on all hardware, particularly for Lenovo and other systems that still require vendor firmware updates to ensure compatibility and load the new certificates into UEFI defaults. Practitioners also warned that automatic certificate deployment can depend on factors such as firmware readiness, telemetry, and whether devices fall into Microsoft's higher-confidence rollout groups. Operational concerns raised include multiple reboot cycles, possible **BitLocker** impacts, scheduled task triggers, and the need to update related Secure Boot-dependent assets including servers, virtual machines, PXE images, and recovery media.
Aug 5, 2026
Microsoft warned that Secure Boot certificates issued in 2011 are nearing expiration and that devices which do not receive the newer 2023 Secure Boot update will generally keep booting, but may stop receiving future boot-chain protections. The gap affects some older Windows systems whose OEMs no longer provide compatible BIOS or UEFI updates, as well as devices running Legacy BIOS, CSM mode, or unsupported Windows 11 configurations with Secure Boot disabled. Microsoft is reportedly skipping incompatible hardware rather than forcing updates that could cause failures, but enterprises may still face compliance, cyber-insurance, and lifecycle-management pressure because those endpoints could miss future `DBX` revocations, Windows Boot Manager updates, and mitigations for bootloader threats such as **BlackLotus**. The transition is also creating planning challenges beyond Windows. Linux distributions that rely on Microsoft-signed **shim** loaders are expected to continue booting on systems that already trust the older Microsoft UEFI CA, but older PCs that never receive firmware updates with the 2023 certificates may have trouble booting newer Linux media or releases. The issue follows Microsoft's broader effort to harden the pre-boot environment after flaws such as `CVE-2024-21302`, a Windows Secure Kernel Mode elevation-of-privilege bug that could let an administrator roll back VBS-related files to bypass protections; Microsoft responded with boot-time code integrity policies, an optional `SkuSiPolicy.p7b` revocation policy, and stronger protections on newer Windows releases. Administrators are being urged to verify Secure Boot update status, update firmware and recovery media where possible, and document compensating controls or replace hardware that cannot be brought forward.
Jun 29, 2026