Kaspersky researchers have disclosed a new UEFI bootkit that gets past Secure Boot on Windows PCs that already carry Microsoft's patches. The malware, called BlackX, abuses Baton Drop (CVE-2022-21894), a flaw the BlackLotus bootkit used after it surfaced in 2022. The gap is not a missing patch. It is a revocation step that many machines never finished, and the timing makes it harder to ignore: the certificate that signs the Windows boot loader expired on October 19.
What the BlackX bootkit does to Secure Boot
Kaspersky's GReAT team found BlackX and described it in a Securelist analysis. The bootkit exploits Baton Drop, and Kaspersky says its exploit is similar to the one BlackLotus used. Mezha reported that Kaspersky called the two "remarkably similar."
Once BlackX is in place, it can enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files. Secure Boot exists to stop untrusted boot code from running before Windows starts. A bootkit that can enroll its own keys undoes that check, and it runs before the operating system's usual defenses load.
The payload is a malicious kernel driver. According to Mezha's summary of the research, the driver disables security-related processes and registry callbacks. It also tampers with Event Tracing for Windows (ETW) providers to blind monitoring tools.
Kaspersky says the driver's tampering runs only when Kaspersky or Avast products are present, and that it does not work against Kaspersky's own products. Exposure to other security tools is unverified. Do not assume your antivirus is safe or blind based on that claim alone.
Why fully patched Windows PCs stay exposed
Baton Drop is not new. BlackLotus has circulated on hacker forums since October 2022. Mezha's report notes that ESET confirmed in March 2023 that BlackLotus used the flaw and could compromise even fully patched Windows 11 systems.
The reason patched PCs remain exposed is a certificate trust problem. Microsoft's Tech Community post on revoking vulnerable boot managers says the company is revoking trust in the Windows Production PCA 2011 certificate. Earlier boot-manager mitigations could be bypassed, including rollback protections shipped in the May 2023 servicing updates.
A patch alone does not finish that job. According to a secondary guide from Safeguard.sh, the Microsoft patch does not automatically revoke the vulnerable certificate. Users must set a registry flag and run a scheduled task. That detail comes from the secondary summary rather than a Microsoft support page, so check Microsoft's documentation before changing anything.
Initial access is the other open question. BlackX requires administrator privileges, which means an attacker must already be inside a network and hold admin rights. How the attacker got there has not been publicly disclosed. That places BlackX in the category of post-breach persistence rather than a drive-by attack.
Who is targeted and why APT41 is only a medium-confidence link
Kaspersky observed the activity in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Those targets point to espionage rather than ransomware. For a typical US home user, the odds of being hit by this specific campaign appear low.
Kaspersky links the campaign to APT41 with medium confidence only. A daily.dev summary of the research says the attribution rests on shared identifiers with an ESET-reported campaign called FishMonger, DLL sideloading patterns, and OLLVM obfuscation common among Chinese-speaking threat actors. The identifier 'xdd', which appears in BlackX payloads, is also part of the case.
Medium confidence means the attribution is a working hypothesis, not a finding. Treat it that way in board briefings and vendor conversations.
The bigger practical impact falls on IT teams. Attackers who already hold admin rights gain a persistent foothold below the operating system. Administrators who manage fleets must finish revocation work that Microsoft's guidance calls for. Home users have less to do, but they still need to run the basic checks.
What the October 19 certificate expiry changes for Windows PCs
Windows Production PCA 2011, the certificate that signs the Windows boot loader, expired on October 19, 2026, according to Windows Latest. Machines that missed the update still boot today. Whether the expiry changes the risk for devices that already installed updates is unclear from the sources I reviewed.
Several Secure Boot certificates from 2011 are rolling off in 2026. The dates below come from the Safeguard.sh guide.
| Certificate | Expiry date |
|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 |
| Microsoft UEFI CA 2011 | June 27, 2026 |
| Windows Production PCA 2011 | October 19, 2026 |
Revocation is also hard to undo. The Safeguard.sh guide says that once revocation is applied, firmware will not boot a PCA 2011 signed boot manager. The change cannot be reverted under Secure Boot, and reformatting the disk does not remove it. Confirm that claim in Microsoft's support documentation first, because it comes from a secondary source.
Certificate trust failures are drawing attention beyond Windows. USA 24 recently reported that GoDaddy revoked 404,607 SSL certificates over a policy mismatch, another reminder that revocation decisions can break things at scale.
How to check your PC and close the Secure Boot gap
Most of these checks are safe to start now. Test the revocation change before you apply it widely.
- Confirm that Secure Boot is enabled in firmware and that the revocation list (DBX) is current. Bellator Cyber's BlackX write-up covers the Secure Boot checks.
- Check whether the 2023 Secure Boot certificates are installed. Microsoft's guidance points to the KB5036210 update path.
- Test revocation on a few sample devices before any fleet-wide rollout. Microsoft's guidance recommends this step.
- Keep BitLocker recovery keys and recovery media within reach before you change anything. A failed boot can lock out a drive.
- Ask your PC maker whether a firmware update exists for your model. The sources I reviewed did not list model-specific fixes.
- Security teams should look for unexpected boot managers, unsigned EFI files and DBX status in Secure Boot logs.
Microsoft's automatic revocation phase, tied to enforcement under KB5025885, had no announced date in the sources I reviewed. Do not wait for a date to start testing.
What to watch next
Microsoft has not issued a BlackX-specific statement in the sources I checked. A short advisory naming the affected boot managers, along with a firm date for automatic revocation, would give administrators something concrete to schedule around.
Watch whether BlackX appears outside the three Central Asian countries Kaspersky named. Kaspersky's claim that the tampering affects only its own and Avast products is one other vendors will need to test. The answer will shape how much attention endpoint tools receive in the next round of reports.
The APT41 attribution will also change as more samples are analyzed. Medium confidence can harden or fade. The undisclosed initial access method is the gap that would most change the risk picture for US enterprises, and it is the detail to track in the coming weeks.
