Kaspersky Reports BlackX Bootkit Bypassing Secure Boot on Patched Windows PCs

Kaspersky published a research report on 22 October 2026 describing BlackX, a UEFI bootkit that bypasses Secure Boot on fully patched Windows machines. Kaspersky found the bootkit in a campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, and dates its discovery to early 2026.

Kaspersky attributes the campaign to APT41 with medium confidence. BlackX is a BlackLotus-like bootkit, and it relies on the same Windows boot-loader flaw, Baton Drop, tracked as CVE-2022-21894. Kaspersky first saw BlackLotus advertised on a hacking forum in October 2022.

How BlackX Gets Onto a Machine

Kaspersky says the attackers first compromised victim networks and obtained administrator privileges. They then dropped an installer, inst.exe, and an RC4-encrypted file, PVMDIJGKAX2, that holds the components the bootkit needs.

Once installed, the bootkit enrols custom Machine Owner Keys, which allow it to load arbitrary EFI files and manipulate Secure Boot. It also injects a malicious kernel driver. According to Kaspersky, that driver disables process, thread and registry callbacks used by security products, and it tampers with ETW providers so that security tools cannot read their output.

Some of the driver’s routines run only when Kaspersky or Avast is present, and Kaspersky says those routines were ineffective against its own products. User-mode payloads include a cloud-based remote access tool that uses Google Drive, OneDrive and Yandex.Disk, along with OxiDLLRunner, a file obfuscated with OLLVM. Kaspersky says the driver’s signing certificate has been revoked by its issuer.

Attribution and Scope
Kaspersky attributes the campaign to APT41 with medium confidence and says its targets were diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan.

Why Fully Patched Machines Stay Exposed

Microsoft patched Baton Drop, but Kaspersky says the fix needs a separate revocation step. this revocation does not happen automatically upon patch installation The vulnerable boot components are signed with the Windows Production PCA 2011 certificate, which Kaspersky says expired on 19 October 2026. Kaspersky adds that vulnerable binaries can still load unless the certificate is blocklisted.

Microsoft’s Secure Boot guidance describes the revocation as a set of checks. Windows first confirms that the Windows UEFI CA 2023 certificate is in the Secure Boot database and that the default boot application is not signed with PCA 2011. If either check fails, Windows intentionally fails the DBX update and logs Event ID 1797 or 1798. Event ID 1037 confirms that PCA 2011 has been revoked in the forbidden signature database.

Kaspersky says Microsoft’s planned enforcement phase, which would revoke the certificate automatically, had not been implemented when its report was published.

What IT Teams Should Check Before Revoking

Kaspersky describes the manual steps as setting a registry flag under the Secureboot key and creating a scheduled task named Secure-Boot-Update. Administrators should confirm the exact commands against Microsoft’s current guidance before running them, because the revocation changes how machines boot.

Microsoft’s event reference says that applying the update may put BitLocker into recovery mode, logged as Event ID 1032, and suggests suspending BitLocker for two restarts. It also warns that boot applications signed with PCA 2011, including those on system recovery media and PXE boot applications, will no longer be trusted when the device starts once the certificate is added to the DBX, so recovery media needs to be checked first.

Microsoft’s 2023 guidance on BlackLotus recommends measures including: restrict local administrative rights, keep Microsoft Defender updated with detection build 383.1029.0 or later for managed fleets, and remove the Microsoft 3rd Party UEFI CA from Secure Boot where the system does not need it to boot. That guidance says removing the CA blocks BlackLotus but does not eliminate the vulnerability.

this revocation does not happen automatically upon patch installation

What Device Buyers Should Ask, and What Remains Open

Microsoft’s event reference lists firmware problems that can stop the update. Event ID 1795 means the firmware returned an error, and Microsoft suggests checking for a firmware update. Event ID 1802 means a known firmware issue blocks the update, and the device vendor should be contacted. Event ID 1808 indicates that a device already has the required new certificates and boot manager.

Buyers can ask device manufacturers for the status of a PK signed KEK for their model. Microsoft’s reference says the KEK CA 2011 and UEFI CA 2011 certificates expire in 2026.

Kaspersky attributes the campaign to APT41 with medium confidence, and says the driver’s signing certificate has been revoked by its issuer. Kaspersky reports that Microsoft’s enforcement phase had not been implemented, and no date for it appears in the report.