BlackX bootkit bypasses Secure Boot on fully patched Windows
First merged summary.
Kaspersky says BlackX used Baton Drop on patched diplomatic PCs because Secure Boot revocations stay off unless enabled by hand.
Kaspersky's October 22, 2026 Securelist report describes BlackX, a UEFI bootkit found in early 2026 on fully patched Windows systems at diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. After gaining administrator rights, attackers used CVE-2022-21894 (Baton Drop) to enroll custom Machine Owner Keys and load EFI files despite Secure Boot. A since-revoked driver interfered with security tools; payloads included a cloud remote-access trojan and OxiDLLRunner. Kaspersky rates an APT41 link as medium confidence. Microsoft's revocation of the Windows Production PCA 2011 certificate, KB5025885 (CVE-2023-24932), ships disabled, so its October 19, 2026 expiration did not by itself stop old signed files from loading.
- Victims were diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan.
- CVE-2022-21894 requires administrator rights to install custom Machine Owner Keys.
- KB5025885, CVE-2023-24932, leaves the PCA 2011 revocation disabled by default.
- NVD scores are 4.4 and 6.7; both flaws need high privileges.
- Command-and-control used Google Drive, OneDrive, or Yandex.Disk.
- Kaspersky rates the APT41 attribution as medium confidence.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026Windows Production PCA 2011 certificate expired. · Hacker News
- Oct 22, 2026Kaspersky published its BlackX Securelist analysis. · Hacker News
What each outlet adds
beyond the shared facts- BleepingComputerNames the revoked driver issuer and googleupdate.exe sideloading of OxiDLLRunner.
- Hacker NewsKB5025885 ships disabled; NVD scores and AvailableUpdates bit checks.
- Cyber Security NewsInstaller has no embedded payloads; OxiDLLRunner runs a Rust executable.
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41FishMonger
- Malware
- BlackXBlackLotusOxiDLLRunner
- Organizations
- Kaspersky
Coverage
oldest first · one row per article · UTC- · 6d ago
BleepingComputerFirst report
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
- · 4d ago
Hacker News · security
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
- · 3d ago
Cyber Security News
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% | ||
| CVE-2023-24932 | Secure Boot Security Feature Bypass Vulnerability | 6.7 | 11% |