Kaspersky finds BlackX bootkit on patched diplomatic Windows PCs
First merged summary.
Fully patched Windows PCs at Central Asian diplomatic agencies stayed exposed to the BlackX bootkit because Secure Boot revocations remain off by default.
On October 22, 2026, Kaspersky reported the BlackX UEFI bootkit on fully patched Windows machines at diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. After gaining administrator rights, attackers used Baton Drop (CVE-2022-21894) to install their own Machine Owner Keys and load a driver that disables security callbacks and tampers with Event Tracing for Windows. Payloads include a cloud-controlled remote-access trojan and OxiDLLRunner, which runs a Rust executable and extra DLL plugins. Kaspersky rates an APT41 link as medium confidence. Microsoft's revocation of the Windows Production PCA 2011 certificate (KB5025885, CVE-2023-24932) ships disabled; an Updated 2023 certificate does not mean PCA 2011 is blocklisted, and its October 19, 2026 expiry did not by itself block old signed files.
- Kaspersky's GReAT team says it found the attacks in early 2026.
- NVD scores CVE-2022-21894 at 4.4 and CVE-2023-24932 at 6.7; both need high privileges.
- Installer inst.exe uses RC4 file PVMDIJGKAX2 and cloud storage for the RAT.
- AvailableUpdates 0x5944 lacks the 0x80 revocation and 0x200 SVN bits.
- Researchers cite a revoked driver certificate and defanged domain www[.]archivetj[.]com.
- The installer is split from an encrypted package and contains no embedded payloads.
Timeline
dated events in the reporting · oldest first- Oct 19, 2026Windows Production PCA 2011 certificate expired · Hacker News
- Oct 22, 2026Kaspersky reported BlackX on diplomatic Windows PCs · Hacker News
What each outlet adds
beyond the shared facts- Hacker NewsKB5025885 stays off unless enabled, plus registry bits and NVD scores.
- Cyber Security NewsOxiDLLRunner, split installer, revoked driver certificate, and archivetj domain.
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41FishMonger
- Malware
- BlackXBlackLotusOxiDLLRunner
- Organizations
- Kaspersky
- Countries
- TajikistanUzbekistanTurkmenistan
Coverage
oldest first · one row per article · UTC- · 6d ago
Hacker News · securityFirst report
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
- · 6d ago
Cyber Security News
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% | ||
| CVE-2023-24932 | Secure Boot Security Feature Bypass Vulnerability | 6.7 | 11% |