# BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation · pwn.watch > Kaspersky GReAT found a new UEFI bootkit, BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and attributed with medium confidence to China-linked APT41. It is a copycat of BlackLotus and exploits Baton Drop (CVE-2022-21894) to install its own Machine Owner Keys, load arbitrary EFI files and inject a kernel driver that blinds security software. The targeted machines were fully patched: Microsoft's fix only revokes the vulnerable "Windows Production PCA 2011" signing certificate after an admin manually sets a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and runs the Secure-Boot-Update task, and Microsoft's planned automatic enforcement phase has not shipped. The certificate expired on Oct 19, 2026, but that does not stop vulnerable boot binaries from loading unless it is in the DBX blocklist. Attackers need admin rights or physical access first, so this is a persistence tool, not an initial access vector. Windows admins should apply Microsoft's Secure Boot revocation steps manually. Page: https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass · generated 2026-10-23T20:14:37.802Z ## Status - Severity: high · status: live · patch: partial - Product: Microsoft Windows Secure Boot (Windows Boot Manager signed by Windows Production PCA 2011) - Started: 2026-10-22 - CVEs: CVE-2022-21894 - Affected: Windows machines with Secure Boot where the Windows Production PCA 2011 certificate has not been added to the Secure Boot DBX, even when fully updated - Fixed in: Protection requires manually enabling Microsoft's Secure Boot revocation (registry flag plus the Secure-Boot-Update scheduled task); see Microsoft's Boot Manager revocation guide; Microsoft's automatic enforcement phase has not shipped yet ## Follow this incident - RSS (one item per update): https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass/feed.xml - JSON Feed: https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass.json - This file: https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass/llms.txt ## Updates (newest first) - 2026-10-23: The Hacker News reports the campaign and the manual revocation gap. (https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html) - 2026-10-22: Kaspersky GReAT publishes its BlackX report: Baton Drop exploited on fully patched machines at Central Asian diplomatic organizations, likely APT41. (https://securelist.com/uefi-bootkit-blackx/121539/) - 2026-10-19: The "Windows Production PCA 2011" certificate expires; Kaspersky notes this does not stop vulnerable binaries from loading unless it is blocklisted. (https://securelist.com/uefi-bootkit-blackx/121539/) ## Fix brief # Security brief: BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation Source: https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass · status: live · severity: high · updated Oct 23, 2026, 20:13 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Kaspersky GReAT found a new UEFI bootkit, BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and attributed with medium confidence to China-linked APT41. It is a copycat of BlackLotus and exploits Baton Drop (CVE-2022-21894) to install its own Machine Owner Keys, load arbitrary EFI files and inject a kernel driver that blinds security software. The targeted machines were fully patched: Microsoft's fix only revokes the vulnerable "Windows Production PCA 2011" signing certificate after an admin manually sets a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and runs the Secure-Boot-Update task, and Microsoft's planned automatic enforcement phase has not shipped. The certificate expired on Oct 19, 2026, but that does not stop vulnerable boot binaries from loading unless it is in the DBX blocklist. Attackers need admin rights or physical access first, so this is a persistence tool, not an initial access vector. Windows admins should apply Microsoft's Secure Boot revocation steps manually. Severity detail: Exploited in the wild by an APT; needs admin or physical access first; CVE-2022-21894 is CVSS 4.4 - Product: Microsoft Windows Secure Boot (Windows Boot Manager signed by Windows Production PCA 2011) - CVE / advisory ids: CVE-2022-21894 ## Affected versions - Windows machines with Secure Boot where the Windows Production PCA 2011 certificate has not been added to the Secure Boot DBX, even when fully updated ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Protection requires manually enabling Microsoft's Secure Boot revocation (registry flag plus the Secure-Boot-Update scheduled task); see Microsoft's Boot Manager revocation guide - Microsoft's automatic enforcement phase has not shipped yet After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Latest updates - Oct 23, 2026: The Hacker News reports the campaign and the manual revocation gap. - Oct 22, 2026: Kaspersky GReAT publishes its BlackX report: Baton Drop exploited on fully patched machines at Central Asian diplomatic organizations, likely APT41. - Oct 19, 2026: The "Windows Production PCA 2011" certificate expires; Kaspersky notes this does not stop vulnerable binaries from loading unless it is blocklisted. ## Advisories - [How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023) (Microsoft) - [NVD: CVE-2022-21894](https://nvd.nist.gov/vuln/detail/CVE-2022-21894) (NVD) ## Write-ups & news - [New BlackX UEFI bootkit exploiting Baton Drop](https://securelist.com/uefi-bootkit-blackx/121539/) - [Kaspersky discovers BlackX bootkit targeting diplomatic organizations in Central Asia](https://www.kaspersky.com/about/press-releases/beneath-the-operating-system-kaspersky-discovers-blackx-bootkit-targeting-diplomatic-organizations-in-central-asia) - [BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations](https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html) --- Machine-readable: https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.