UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

Malware known as BlackX has infected fully patched Windows machines by exploiting a vulnerability in the Windows boot manager, despite Microsoft's efforts to patch the issue in 2022 and 2023. The malware bypasses Secure Boot protections, a security feature that verifies the digital signatures of boot software. This is the first publicly documented in-the-wild UEFI bootkit capable of doing so, and it is not clear how the infected organizations fell victim despite having installed all necessary patches. The malware exploits a 'Baton Drop' logic flaw that allows attackers to bypass Secure Boot and extract BitLocker encryption keys under certain conditions. Microsoft's Secure Boot protections were meant to prevent this type of attack, but the UEFI firmware's chain-of-trust mechanism was subverted by the malware, allowing it to run malicious code before Windows was fully loaded. Microsoft had issued multiple updates to address the vulnerability, including a new certificate that no longer trusts vulnerable boot managers and the means to revoke trust in older vulnerable Windows boot managers, but the patches did not prevent the infection. The malware's ability to bypass Secure Boot protections raises questions about Microsoft's clarity around Secure Boot protections and whether the company bears responsibility for the infection.