BlackX UEFI Bootkit Bypasses Secure Boot on Fully Patched Windows Systems

Security researchers have confirmed that a new UEFI bootkit, tracked as BlackX, successfully infected Windows 11 systems that had every available Microsoft patch installed. Like its predecessor BlackLotus, BlackX exploits CVE-2022-21894 — a logic error in the Windows boot manager known as "Baton Drop" — to subvert the Secure Boot chain of trust before the operating system loads.

Microsoft addressed the underlying vulnerability in 2022 but declined to revoke the signing certificates for older, vulnerable boot managers. That decision left a window for attackers to roll back the boot partition to a trusted-but-flawed manager, then execute malicious kernel-mode drivers before endpoint defenses activate.

Why it matters for GPU and AI infrastructure

AI training clusters and inference servers often run unattended in data centers, making firmware persistence a critical risk. A bootkit that survives OS reinstallation can exfiltrate model weights, poison training data, or hijack GPU resources for cryptomining — all while evading conventional host-based monitoring. Hardware-rooted attestation and automated certificate revocation enforcement are becoming non-negotiable for any serious AI compute platform.

Operators should verify that their firmware update pipelines enforce certificate revocation lists (CRLs) and that Secure Boot policy enforcement includes measured boot logs sent to a trusted collector. AiGpu's managed GPU cloud incorporates hardware-rooted trust anchors and continuous firmware integrity verification to mitigate precisely this class of supply-chain threat.