BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation
Microsoft Windows Secure Boot (Windows Boot Manager signed by Windows Production PCA 2011)
Kaspersky GReAT found a new UEFI bootkit, BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and attributed with medium confidence to China-linked APT41. It is a copycat of BlackLotus and exploits Baton Drop (CVE-2022-21894) to install its own Machine Owner Keys, load arbitrary EFI files and inject a kernel driver that blinds security software. The targeted machines were fully patched: Microsoft's fix only revokes the vulnerable "Windows Production PCA 2011" signing certificate after an admin manually sets a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and runs the Secure-Boot-Update task, and Microsoft's planned automatic enforcement phase has not shipped. The certificate expired on Oct 19, 2026, but that does not stop vulnerable boot binaries from loading unless it is in the DBX blocklist. Attackers need admin rights or physical access first, so this is a persistence tool, not an initial access vector. Windows admins should apply Microsoft's Secure Boot revocation steps manually.
Why this severity: Exploited in the wild by an APT; needs admin or physical access first; CVE-2022-21894 is CVSS 4.4
- Started
- Oct 22, 2026
Affected
- Windows machines with Secure Boot where the Windows Production PCA 2011 certificate has not been added to the Secure Boot DBX, even when fully updated
Fixed in
- Protection requires manually enabling Microsoft's Secure Boot revocation (registry flag plus the Secure-Boot-Update scheduled task); see Microsoft's Boot Manager revocation guide
- Microsoft's automatic enforcement phase has not shipped yet
Timeline3
The Hacker News reports the campaign and the manual revocation gap.
Kaspersky GReAT publishes its BlackX report: Baton Drop exploited on fully patched machines at Central Asian diplomatic organizations, likely APT41.
The "Windows Production PCA 2011" certificate expires; Kaspersky notes this does not stop vulnerable binaries from loading unless it is blocklisted.
Advisories2
News & write-ups3
- New BlackX UEFI bootkit exploiting Baton DropKaspersky Securelist · Oct 22, 2026 · Write-up
- Kaspersky discovers BlackX bootkit targeting diplomatic organizations in Central AsiaKaspersky
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing RevocationsThe Hacker News · Oct 23, 2026
Get an email when a new major security incident drops. No spam, unsubscribe any time.
