BlackX Bootkit: How Attackers Bypass Windows Secure Boot on Patched Systems
A sophisticated UEFI bootkit called BlackX has been observed in targeted cyberespionage campaigns against diplomatic organizations in Central Asia. Even on systems that showed up-to-date Windows patches, attackers found a path to run code before Windows started by exploiting gaps in how Secure Boot protections were deployed. The discovery highlights a subtle but critical distinction between installing updates and fully activating the firmware-level protections those updates are intended to enable.…