Installing the Windows update is not always enough. That is the message from BlackX, a malware found by Kaspersky that installs itself before the operating system even starts and slips past Secure Boot on computers that had the fix but skipped a manual step.
What a bootkit is
Secure Boot is the protection that checks that what loads when a PC starts is trustworthy. BlackX is a UEFI bootkit, malicious code that runs in that phase, before Windows and before antivirus. Kaspersky describes it as an updated version of BlackLotus, a known bootkit. Its goal is to stay hidden and dodge defenses.
The flaw the fix did not close
BlackX exploits CVE-2022-21894, known as Baton Drop, which Microsoft has already patched. The catch is that the fix only works fully if the administrator also performs manual revocation steps. Without them, the vulnerable boot files still load, because the “Windows Production PCA 2011” certificate is not on Secure Boot’s blocklist, the DBX. That certificate expired on October 19, 2026, but expiry alone does not stop the files from loading.
The attacker needs administrator privileges on the machine, typically gained after breaking into the network some other way. It then installs its files, and the aim is to enroll its own keys so it can load whatever it wants and interfere with Secure Boot. Payloads include a driver that tampers with security software and a remote access trojan that takes orders through Google Drive, OneDrive and Yandex.Disk.
Who was attacked
According to Kaspersky, the targets were diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The company suspects the China-linked group APT41, but the attribution is only a suspicion. The report mentions no attacks on ordinary users.
How to protect yourself
- Apply Windows updates, but know they are not enough for this case.
- Anyone who manages company computers should apply Microsoft’s Secure Boot revocation mitigations, including adding the Windows Production PCA 2011 certificate to the DBX.
- Keep Secure Boot on in the firmware settings (BIOS/UEFI).
- Do not use an administrator account day to day. The bootkit needs that level of access to install.
- Be wary of unknown programs and attachments, because the attack starts with another break-in.
