BlackLotus UEFI bootkit compromises fully patched Windows systems
A UEFI-level bootkit identified as BlackLotus has demonstrated the ability to bypass Secure Boot protections on updated Windows 11 systems, exposing critical firmware vulnerabilities.
Ars Technica reports that the BlackLotus malware has successfully compromised Windows 11 systems by bypassing the Secure Boot chain-of-trust mechanism. As a UEFI bootkit, the malicious code executes before the operating system finishes loading, effectively neutralizing many standard security defenses that rely on the OS environment.
Microsoft has issued multiple security updates since 2022 to mitigate the vulnerabilities leveraged by BlackLotus, including the introduction of new certificates and the revocation of older, vulnerable boot managers. However, evidence suggests that these measures have not fully prevented infections in environments where all patches were applied, prompting scrutiny regarding the efficacy of current remediation strategies.
UEFI firmware acts as the foundational layer of system initialization. By operating at this level, BlackLotus gains control over the machine before security protocols are fully established. The persistence of these attacks indicates a complex challenge for hardware and software vendors in securing the critical boot process against advanced persistent threats.