BlackX bootkit hit patched Windows missing Secure Boot revocations

A UEFI bootkit tracked as BlackX infected fully patched Windows machines by bypassing Secure Boot, even after years of Microsoft updates meant to close the hole it uses.¹²

Kaspersky found the campaign in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. Attackers already had administrator rights on the networks before they dropped the bootkit. The install package used an executable and an encrypted companion file under a ProgramData path, then wrote components to both the system and UEFI partitions.³²

UEFI is the firmware that runs right after power-on: it sets up hardware and hands off to the operating system. Secure Boot is the check that tries to make sure each piece of boot software is digitally signed before it runs. BlackX, like the earlier BlackLotus bootkit, abuses a logic flaw in the Windows boot manager known as Baton Drop, or CVE-2022-21894. That flaw lets an attacker with high privileges load older, still-trusted boot code, enroll custom Machine Owner Keys, and run unauthorized EFI files before Windows and many defenses are up.¹³

Seen it before: a patch lands, the old signed binary stays trusted, and the gap becomes the feature attackers wait on.

BlackLotus was the first publicly documented in-the-wild UEFI bootkit that could bypass Secure Boot on fully updated Windows 11. It was advertised on hacking forums from late 2022 and confirmed by ESET in March 2023. Microsoft had fixed the underlying vulnerability in 2022, but trust in the certificate that signed older vulnerable boot managers was not revoked at the same time. BlackLotus used that gap. BlackX’s exploit chain is “remarkably similar,” Kaspersky reported; the firm assesses the operators reverse-engineered BlackLotus or obtained its source, including code not present in an incomplete 2023 leak.¹³

After the boot stage, BlackX injects a malicious kernel driver signed with a certificate issued to Wenjiang District Mingyu Network Technology Service Studio; that certificate has since been revoked. The driver tampers with security-related processes, registry callbacks, and Event Tracing for Windows. Some of those routines run only if Kaspersky or Avast products are detected; Kaspersky says the tampering does not work against its own tools. The driver also shields bootkit files and deploys espionage payloads: a remote-access tool that uses Google Drive, OneDrive, or Yandex.Disk for command and control, and a sideloaded DLL (OxiDLLRunner) that launches further Rust-based plugins from a remote host.²⁴

The infected organizations had installed the available patches. That is the part that matters for anyone still running Windows with Secure Boot. In May 2023 Microsoft began a longer mitigation: a new signing certificate (Windows UEFI CA 2023) and, later, a way to put the old Windows Production PCA 2011 certificate into Secure Boot’s forbidden-signatures database. The updates alone did not finish the job. Fear of leaving machines unbootable if they had not received every prior step kept automatic, universal revocation off the table. Administrators still had to take extra manual action to activate the revocation. Kaspersky’s researchers called that practice a problem because most admins stop after a successful update install, and the activation steps sit deep in Microsoft documentation.¹²

A Microsoft representative pointed customers to a Knowledge Base article published about two weeks before the Ars Technica report. That article, Ars noted, does not warn that the patches released so far leave systems open to Baton Drop until the old certificate is manually revoked. The 2011 certificate expired on October 19, 2026; expiration alone does not stop vulnerable binaries from loading unless the certificate is blocklisted.¹²

Attribution is medium-confidence linkage to APT41 (also tracked under other names), drawing in part on overlaps with earlier FishMonger activity and shared strings. Bootkits are persistence and defense-evasion tools, not the first way in; Microsoft has said the same about this class of attack. They can be hard to spot without specialized tooling and can survive an OS reinstall if the infected boot partition is left alone.²⁴

What you should do: If you administer Windows machines with Secure Boot, install the current updates and complete the manual Secure Boot revocation steps Microsoft documents for Baton Drop (CVE-2022-21894)—including adding the Windows Production PCA 2011 certificate to the UEFI forbidden list (DBX) where your hardware and process allow it. Confirm the revocation actually applied; do not assume the patch install finished the work. Home-user status for the same steps is not spelled out clearly in the coverage. Changing everyday account passwords is cheap insurance after any privileged compromise, but it does not remove a bootkit; that needs the boot chain cleaned and the revocations enforced.¹²

Microsoft’s next plain disclosure on whether revocation will ever be automatic—and on how it will say so in the articles admins actually read—remains the item to watch.

Our read: The technical story is not a brand-new zero-day; it is a years-long half-closed door. BlackLotus proved the bypass in 2023; BlackX shows the same class of attack still works in 2026 on boxes that took every automatic update and skipped the buried manual step. Microsoft is stuck between bricking machines that never got the new trust material and leaving the old certificate trusted long enough for a determined operator to notice. Clearer risk language in the same KB posts that tell people to patch would not invent a safer boot chain, but it would stop treating “install update” as the whole sentence when the sentence still has a second clause. Until revocation is default or the warning is impossible to miss, fully patched will keep meaning less than the label suggests.

Footnotes

1. Ars Technica, “UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?”. Retrieved November 4, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. BleepingComputer, “BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot”. Retrieved November 4, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

3. Securelist, “How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia”. Retrieved November 4, 2026. ↩ ↩² ↩³

4. The Hacker News, “BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations”. Retrieved November 4, 2026. ↩ ↩²