# BlackX Bootkit Bypasses Secure Boot on Fully Patched Windows PCs

- URL: https://usa-24.com/blackx-uefi-bootkit-secure-boot/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T13:37:39.759Z
- Updated: 2026-10-25T13:37:39.764Z
- Topics: Secure Boot, Windows Security, Bootkits, UEFI, Certificate Revocation

> Kaspersky says the BlackX bootkit exploits the years-old Baton Drop flaw to bypass Secure Boot on fully patched Windows PCs that never finished a manual revocation step.

## Key takeaways

- Kaspersky's BlackX bootkit exploits Baton Drop (CVE-2022-21894) and can enroll custom Machine Owner Keys to load arbitrary EFI files.
- Fully patched Windows PCs stay exposed until the vulnerable Windows Production PCA 2011 certificate is revoked, and that step is not automatic.
- The Windows Production PCA 2011 certificate expired on October 19, 2026, after Microsoft's KEK CA 2011 and UEFI CA 2011 certificates expired in June.
- Kaspersky observed the campaign in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and links it to APT41 with medium confidence.
- Test revocation on sample devices and keep BitLocker recovery keys ready before any fleet-wide change.

Kaspersky researchers have disclosed a new UEFI bootkit that gets past Secure Boot on Windows PCs that already carry Microsoft's patches. The malware, called BlackX, abuses Baton Drop (CVE-2022-21894), a flaw the BlackLotus bootkit used after it surfaced in 2022. The gap is not a missing patch. It is a revocation step that many machines never finished, and the timing makes it harder to ignore: the certificate that signs the Windows boot loader expired on October 19.

## What the BlackX bootkit does to Secure Boot

Kaspersky's GReAT team found BlackX and described it in a [Securelist analysis](https://securelist.com/uefi-bootkit-blackx/121539/). The bootkit exploits Baton Drop, and Kaspersky says its exploit is similar to the one BlackLotus used. Mezha reported that Kaspersky called the two "remarkably similar."

Once BlackX is in place, it can enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files. Secure Boot exists to stop untrusted boot code from running before Windows starts. A bootkit that can enroll its own keys undoes that check, and it runs before the operating system's usual defenses load.

The payload is a malicious kernel driver. According to [Mezha's summary](https://mezha.net/eng/news/mezha-12bc54495bb6118bb12b0695_blackx_uefi_bootkit) of the research, the driver disables security-related processes and registry callbacks. It also tampers with Event Tracing for Windows (ETW) providers to blind monitoring tools.

Kaspersky says the driver's tampering runs only when Kaspersky or Avast products are present, and that it does not work against Kaspersky's own products. Exposure to other security tools is unverified. Do not assume your antivirus is safe or blind based on that claim alone.

## Why fully patched Windows PCs stay exposed

Baton Drop is not new. BlackLotus has circulated on hacker forums since October 2022. Mezha's report notes that ESET confirmed in March 2023 that BlackLotus used the flaw and could compromise even fully patched Windows 11 systems.

The reason patched PCs remain exposed is a certificate trust problem. Microsoft's [Tech Community post on revoking vulnerable boot managers](https://techcommunity.microsoft.com/blog/windows-itpro-blog/revoking-vulnerable-windows-boot-managers/4121735) says the company is revoking trust in the Windows Production PCA 2011 certificate. Earlier boot-manager mitigations could be bypassed, including rollback protections shipped in the May 2023 servicing updates.

A patch alone does not finish that job. According to a secondary guide from [Safeguard.sh](https://safeguard.sh/resources/blog/secure-boot-certificate-rotation-2026-what-breaks-and-what-to-do), the Microsoft patch does not automatically revoke the vulnerable certificate. Users must set a registry flag and run a scheduled task. That detail comes from the secondary summary rather than a Microsoft support page, so check Microsoft's documentation before changing anything.

Initial access is the other open question. BlackX requires administrator privileges, which means an attacker must already be inside a network and hold admin rights. How the attacker got there has not been publicly disclosed. That places BlackX in the category of post-breach persistence rather than a drive-by attack.

## Who is targeted and why APT41 is only a medium-confidence link

Kaspersky observed the activity in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Those targets point to espionage rather than ransomware. For a typical US home user, the odds of being hit by this specific campaign appear low.

Kaspersky links the campaign to APT41 with medium confidence only. A [daily.dev summary](https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv) of the research says the attribution rests on shared identifiers with an ESET-reported campaign called FishMonger, DLL sideloading patterns, and OLLVM obfuscation common among Chinese-speaking threat actors. The identifier 'xdd', which appears in BlackX payloads, is also part of the case.

Medium confidence means the attribution is a working hypothesis, not a finding. Treat it that way in board briefings and vendor conversations.

The bigger practical impact falls on IT teams. Attackers who already hold admin rights gain a persistent foothold below the operating system. Administrators who manage fleets must finish revocation work that Microsoft's guidance calls for. Home users have less to do, but they still need to run the basic checks.

## What the October 19 certificate expiry changes for Windows PCs

Windows Production PCA 2011, the certificate that signs the Windows boot loader, expired on October 19, 2026, according to [Windows Latest](https://www.windowslatest.com/2026/10/17/windows-11s-last-secure-boot-deadline-hits-monday-microsoft-reveals-what-happens-to-your-pc/). Machines that missed the update still boot today. Whether the expiry changes the risk for devices that already installed updates is unclear from the sources I reviewed.

Several Secure Boot certificates from 2011 are rolling off in 2026. The dates below come from the Safeguard.sh guide.

| Certificate | Expiry date |
|---|---|
| Microsoft Corporation KEK CA 2011 | June 24, 2026 |
| Microsoft UEFI CA 2011 | June 27, 2026 |
| Windows Production PCA 2011 | October 19, 2026 |

Revocation is also hard to undo. The Safeguard.sh guide says that once revocation is applied, firmware will not boot a PCA 2011 signed boot manager. The change cannot be reverted under Secure Boot, and reformatting the disk does not remove it. Confirm that claim in Microsoft's support documentation first, because it comes from a secondary source.

Certificate trust failures are drawing attention beyond Windows. USA 24 recently reported that [GoDaddy revoked 404,607 SSL certificates](https://usa-24.com/godaddy-ssl-certificates-revoked/) over a policy mismatch, another reminder that revocation decisions can break things at scale.

## How to check your PC and close the Secure Boot gap

Most of these checks are safe to start now. Test the revocation change before you apply it widely.

1. Confirm that Secure Boot is enabled in firmware and that the revocation list (DBX) is current. [Bellator Cyber's BlackX write-up](https://bellatorcyber.com/blog/blackx-uefi-bootkit-baton-drop-secure-boot-bypass) covers the Secure Boot checks.
2. Check whether the 2023 Secure Boot certificates are installed. Microsoft's guidance points to the KB5036210 update path.
3. Test revocation on a few sample devices before any fleet-wide rollout. Microsoft's guidance recommends this step.
4. Keep BitLocker recovery keys and recovery media within reach before you change anything. A failed boot can lock out a drive.
5. Ask your PC maker whether a firmware update exists for your model. The sources I reviewed did not list model-specific fixes.
6. Security teams should look for unexpected boot managers, unsigned EFI files and DBX status in Secure Boot logs.

Microsoft's automatic revocation phase, tied to enforcement under KB5025885, had no announced date in the sources I reviewed. Do not wait for a date to start testing.

## What to watch next

Microsoft has not issued a BlackX-specific statement in the sources I checked. A short advisory naming the affected boot managers, along with a firm date for automatic revocation, would give administrators something concrete to schedule around.

Watch whether BlackX appears outside the three Central Asian countries Kaspersky named. Kaspersky's claim that the tampering affects only its own and Avast products is one other vendors will need to test. The answer will shape how much attention endpoint tools receive in the next round of reports.

The APT41 attribution will also change as more samples are analyzed. Medium confidence can harden or fade. The undisclosed initial access method is the gap that would most change the risk picture for US enterprises, and it is the detail to track in the coming weeks.

## Frequently asked questions

### Is my Windows PC vulnerable to the BlackX bootkit?

BlackX targets Windows PCs that use UEFI firmware and Secure Boot and that are missing the manual revocation step. An attacker must already hold administrator rights. Kaspersky has observed the campaign only against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan, so home users are less likely targets. The revocation gap still applies to any Windows machine that has not finished it.

### What is CVE-2022-21894 (Baton Drop)?

CVE-2022-21894 is the Baton Drop Secure Boot bypass flaw. The BlackLotus bootkit used it after circulating on hacker forums from October 2022. ESET confirmed in March 2023 that BlackLotus could compromise even fully patched Windows 11 systems with it. Installing patches alone does not close the gap, because the vulnerable certificate also has to be revoked.

### Did the Windows Production PCA 2011 certificate expire on October 19, 2026?

Yes. Windows Latest reported that the Windows Production PCA 2011 certificate, which signs the Windows boot loader, expired on October 19, 2026. Machines that missed the update still boot today. The sources I reviewed do not say whether the expiry changes the risk for devices that already installed updates.

### Can I undo Microsoft's Secure Boot revocation?

According to a secondary guide from Safeguard.sh, a revocation cannot be reverted under Secure Boot, and reformatting the disk does not remove it. Because that claim comes from a secondary source, confirm it in Microsoft's support documentation before you apply any change. Keep BitLocker recovery keys ready first.

### Who is behind the BlackX bootkit?

Kaspersky links BlackX to APT41 with medium confidence only. The attribution rests on shared identifiers with an ESET-reported campaign called FishMonger, DLL sideloading patterns, OLLVM obfuscation and the 'xdd' string found in BlackX payloads. Treat the attribution as a working hypothesis until more evidence emerges.

## Sources

1. [New BlackX UEFI bootkit exploiting Baton Drop - Securelist (Kaspersky)](https://securelist.com/uefi-bootkit-blackx/121539/)
2. [BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations - The Hacker News](https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html)
3. [BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot - Mezha](https://mezha.net/eng/news/mezha-12bc54495bb6118bb12b0695_blackx_uefi_bootkit)
4. [New BlackX UEFI bootkit exploiting Baton Drop - daily.dev](https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv)
5. [BlackX Bootkit Exploits Baton Drop to Beat Secure Boot - Bellator Cyber](https://bellatorcyber.com/blog/blackx-uefi-bootkit-baton-drop-secure-boot-bypass)
6. [Windows 11's last Secure Boot deadline hits Monday, Microsoft reveals what happens to your PC - Windows Latest](https://www.windowslatest.com/2026/10/17/windows-11s-last-secure-boot-deadline-hits-monday-microsoft-reveals-what-happens-to-your-pc/)
7. [Secure Boot Certificate Rotation 2026: What Breaks and What to Do - Safeguard.sh](https://safeguard.sh/resources/blog/secure-boot-certificate-rotation-2026-what-breaks-and-what-to-do)
8. [Revoking vulnerable Windows boot managers - Microsoft Tech Community](https://techcommunity.microsoft.com/blog/windows-itpro-blog/revoking-vulnerable-windows-boot-managers/4121735)