A January 2022 patch fixed flaws used by Windows UEFI bootkit BlackLotus, but PCs are at risk as Microsoft hasn't put vulnerable binaries on a revocation list
Researchers on Wednesday announced a major cybersecurity find—the world's first-known instance of real-world malware that can hijack … Tweets: @arstechnica : Researchers are sounding the alarm on the world's first-known instance of real-world malware that can hijack a computer's boot process even when Secure Boot and other advanced protections are enabled. https://arstechnica.com/...
Context & Ripple Effects
The UEFI bootkit arc has been building for over a year: Kaspersky documented a firmware rootkit active since 2016 that survives reinstalls (a malicious UEFI-based rootkit), then the MoonBounce bootkit showed persistence even after a hard-drive swap. Last week ESET detailed BlackLotus itself — on sale for $5K since October 2022 and able to bypass Secure Boot on fully updated Windows 11 machines.
Today's development closes the loop on the defense side: the vulnerabilities BlackLotus exploits were actually fixed in a January 2022 Microsoft patch, but the vulnerable signed Windows binaries remain trusted because Microsoft has not added them to the Secure Boot revocation list. Until that revocation lands, the patch alone does not stop an attacker from installing the bootkit.
First-order effects
- Windows users who believe they are protected are not: any PC whose firmware trusts Microsoft's existing signed binaries can be infected with BlackLotus regardless of the January 2022 patch being applied.
- Microsoft now owns the decision point — issuing a revocation would neutralize the attack but forces every Windows machine through a firmware trust update, where mistakes risk unbootable systems.
Second-order effects
- Security teams have to treat 'patched' as insufficient for bootkit-class threats, adding manual checks for BlackLotus persistence rather than relying on Windows Update status.
- Vendors selling the kit at $5K lower the entry barrier, pushing more adversaries toward firmware-level attacks and increasing demand on endpoint vendors like ESET and Kaspersky, who have published the detection research in this space.
Third-order effects
- If Microsoft's reluctance to revoke becomes a template, the Secure Boot promise — that only trusted signed code runs at boot — erodes into a weaker guarantee, and the industry will need faster, less disruptive revocation mechanisms.
- The pattern across LogoFAIL, MoonBounce, and BlackLotus suggests firmware is shifting from a trusted layer below the OS to an actively contested attack surface, which is consistent with Microsoft later auditing open-source bootloaders with AI tooling (Security Copilot finding 20 bootloader vulnerabilities) and bootkits expanding to Linux (ESET's first Linux-targeting UEFI bootkit).
The trend: Boot-level malware is commoditizing faster than the UEFI trust infrastructure can respond, turning revocation lag — not missing patches — into the defining weakness of Secure Boot.