# BlackX bootkit infected Windows systems with security patches installed

_Published Tuesday, November 3, 2026 at 2:26 PM EST · Security · Latest · Tier 2 — Notable_

![A stylized skull and crossbones made out of ones and zeroes. — Primary](https://cdn.arstechnica.net/wp-content/uploads/2020/10/malware-1000x648.jpg)

A bootkit called BlackX infected organizations that had installed Microsoft's fixes and subsequent security updates for a Windows boot-manager vulnerability, Ars Technica reported. The malware exploits CVE-2022-21894, known as Baton Drop, to bypass Secure Boot, the signature checks intended to prevent unauthorized software from running as a computer starts.

Microsoft fixed the flaw in 2022. Updates in 2023 and 2024 added a new certificate and a means to revoke trust in the certificate signing older vulnerable boot managers. The infected organizations had installed those updates. The vulnerability can also allow extraction of BitLocker encryption keys under certain conditions.

## Sources

- [Ars Technica](https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/)

---
Canonical: https://techandbusiness.org/newswire/FHn86aB-sOkaWPad-tu8DX
Published: 2026-11-03T19:26:51.232Z
Story chronology: 2026-11-03T16:03:13.000Z
Retrieved: 2026-11-03T22:24:18.233Z
Publisher: Tech & Business (techandbusiness.org)