#Bootkit

BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation

Kaspersky GReAT found a new UEFI bootkit, BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and attributed with medium confidence to China-linked APT41. It is a copycat of BlackLotus and exploits Baton Drop (CVE-2022-21894) to install its own Machine Owner Keys, load arbitrary EFI files and inject a kernel driver that blinds security software. The targeted machines were fully patched: Microsoft's fix only revokes the vulnerable "Windows Production PCA 2011" signing certificate after an admin manually sets a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and runs the Secure-Boot-Update task, and Microsoft's planned automatic enforcement phase has not shipped. The certificate expired on Oct 19, 2026, but that does not stop vulnerable boot binaries from loading unless it is in the DBX blocklist. Attackers need admin rights or physical access first, so this is a persistence tool, not an initial access vector. Windows admins should apply Microsoft's Secure Boot revocation steps manually.

Microsoft Windows Secure Boot (Windows Boot Manager signed by Windows Production PCA 2011)·Since Oct 22, 2026·updated Oct 23, 2026, 20:13 UTC