BlackX Bootkit Beats Secure Boot on Fully Patched Windows
Kaspersky found BlackX, a UEFI bootkit used against Central Asian diplomats that bypasses Secure Boot via Baton Drop because Microsoft's revocation step was never applied. Medium-confidence link to APT41.
Kaspersky has found a new UEFI bootkit, BlackX, that beats Secure Boot on fully patched Windows machines using Baton Drop, the same 2022 bug BlackLotus relied on. According to Kaspersky’s Securelist report, it turned up in early 2026 in an espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The patches were installed. The catch is that Microsoft’s fix for Baton Drop only fully takes effect after a manual step most organizations never took. Kaspersky links BlackX to APT41 with medium confidence.
For defenders
The bug: CVE-2022-21894 (Baton Drop), a Secure Boot bypass rated CVSS 4.4 because it needs admin rights first. Completing the fix means revoking the “Windows Production PCA 2011” certificate, which requires setting a registry flag under the Secureboot key and running the Secure-Boot-Update scheduled task. Kaspersky says Microsoft’s automatic enforcement phase still hadn’t arrived at publication, and the certificate expiring on Oct. 19, 2026 doesn’t help: old signed boot binaries still load unless the certificate is on the revocation list.
How the attack works: the attackers already had admin rights. An installer (inst.exe) and an RC4-encrypted payload file install custom Machine Owner Keys, so arbitrary EFI code can load at boot: T1542.003 (Pre-OS Boot: Bootkit). A kernel driver, signed with a since-revoked certificate belonging to a Chinese organization, removes security products’ process, thread and registry callbacks and tampers with ETW, which is T1685 (Disable or Modify Tools). It also hides the bootkit’s files by handing back a handle to calc.exe when anything tries to open them, T1014 (Rootkit).
Payloads: a RAT that uses Google Drive, OneDrive and Yandex.Disk for command and control, T1102.002 (Web Service: Bidirectional Communication). A second loader, OxiDLLRunner, is side-loaded by a renamed jcef_helper.exe posing as googleupdate.exe, T1574.001 (Hijack Execution Flow: DLL), and decrypts a Rust payload that talks to the domain below. Kaspersky published no full IOC list in the post.
www[.]archivetj[.]com (OxiDLLRunner payload C2)inst.exe (installer)
PVMDIJGKAX2 (RC4-encrypted payload container)
googleupdate.exe, MD5 AF8A983B9ADA07EAE1259BF2953ABD40 (renamed jcef_helper.exe, side-load host)
v8_context_snapshot.bin (encrypted Rust payload)What it means for you
A bootkit loads before Windows does, so antivirus can’t easily see or remove it, and reinstalling Windows may not get rid of it. This campaign went after diplomats in Central Asia, not home users. The wider lesson is that “fully updated” didn’t mean “protected” here, because one part of Microsoft’s fix has to be switched on by hand.
Do this now
- IT teams: apply Microsoft’s Secure Boot revocation steps for Baton Drop and BlackLotus (KB5025885). Test on a few machines first, since Microsoft warns the revocation can’t be undone and can break older boot media.
- Check machines for unexpected Machine Owner Keys and for the file names and hash above.
- Limit who holds local and domain admin rights. BlackX needed admin access before it could install anything.
CVE at a glance
- CVSS
- 4.4 Medium (v3.1)
- EPSS
- 6.8% chance of exploitation in the next 30 days (higher than 93.9% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 6 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.