UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
Summary
The article analyzes the BlackX and BlackLotus UEFI bootkits that bypass Secure Boot even on patched Windows, detailing CVE-2022-21894 and the incomplete patch strategy. It underscores the difficulties of revoking trust in legacy certificates, the ongoing risk from boot-level malware, and the need for clearer guidance for administrators. It provides insight into attacker methods and the importance of robust firmware and patch management in enterprise security.