Microsoft patched CVE-2022-21894 in January 2022. The vulnerable binaries were never revoked from the UEFI revocation list. Over a year later, BlackLotus used those same signed binaries to bypass Secure Boot on fully updated Windows 11 systems. 80KB. $5,000 on underground forums. Disables HVCI via a single registry write. Suspends BitLocker programmatically. Patches Windows Defender out of memory at boot. Enrolls its own MOK key through a legitimate Microsoft-signed shim. Kernel driver triggers BSOD if you try to remove its files. A patch that never revoked the vulnerable binaries was never really a patch. Understanding this attack chain matters for anyone working in malware analysis, threat intelligence, or detection engineering. If your threat model assumes Secure Boot protects you, read this. https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ Author: @ESETresearch #Malware #ThreatIntel #InfoSec
Post summary
Microsoft patched CVE‑2022‑21894 but failed to revoke the vulnerable binaries, allowing BlackLotus to exploit them on fully updated Windows 11 machines by bypassing Secure Boot, disabling HVCI and BitLocker, and deploying a kernel driver that forces a BSOD.
