New BlackX Bootkit Slips Past Secure Boot on Fully Patched PCs Because a Manual Windows Fix Was Never Switched On
Kaspersky has found a BlackLotus-style UEFI bootkit, BlackX, used against diplomatic targets in Central Asia. It exploits a 2022 Secure Boot flaw on machines that installed the patch but never completed Microsoft’s manual revocation step. Here is the anatomy of the attack and a checklist for your own fleet.
Installing a Windows update usually feels like the end of the job. A new piece of malware shows why, for one Secure Boot flaw, it was only the beginning. Kaspersky researchers have documented BlackX, a UEFI bootkit used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan, which they suspect is linked to the China-associated group APT41.
This breakdown is based on The Hacker News’ coverage and Kaspersky’s Securelist report.
Anatomy of BlackX
- Family: an updated version of BlackLotus, the bootkit first advertised on criminal forums in late 2022. BlackLotus’s source code was never public, so the attackers either reverse-engineered it or bought it.
- Flaw exploited: CVE-2022-21894, known as Baton Drop, a Secure Boot bypass that lets malicious code load before Windows starts.
- Prerequisite: administrator rights or physical access. Microsoft has said this kind of bootkit is a persistence and evasion tool, not a way in. In this campaign, attackers broke in by an unknown method first.
- Install: an installer, inst.exe, and an encrypted data file dropped under C:\ProgramData\Intel, which then write files to the system and UEFI partitions and install Machine Owner Keys so arbitrary boot files can load.
- Kernel stage: a malicious driver, signed with a certificate that has since been revoked, that tries to tamper with endpoint security software.
- Payloads: a remote access trojan that uses Google Drive, OneDrive and Yandex.Disk for command and control, and a DLL called OxiDLLRunner, sideloaded by a legitimate googleupdate.exe, that launches a Rust payload.
The gap it exploits
Microsoft’s fix for Baton Drop includes a step that does not happen automatically: revoking the “Windows Production PCA 2011” certificate by adding it to the Secure Boot forbidden list (DBX). It was left manual partly because automatic revocation could break dual-boot systems. Kaspersky found that attackers are counting on organizations never taking that extra step, which leaves Baton Drop usable on machines that look fully patched. Kaspersky also notes that the certificate expired on October 19, 2026, but expiry alone does not stop vulnerable boot files from loading unless the certificate is on the blocklist.
Fleet checklist
- Find out whether your Windows devices have had the Secure Boot revocations applied, using Microsoft’s guidance on boot manager revocations. Test on a few machines first, since revocation can affect recovery media and dual-boot setups.
- Confirm Secure Boot is turned on in firmware across your laptops and desktops, and keep firmware updated through the manufacturer.
- Treat local administrator rights as the real front door. Remove them from everyday accounts, since BlackX needs them to install.
- Watch for endpoint security tools that suddenly stop reporting, which can be a sign of kernel-level tampering.
- Flag unusual traffic from workstations to consumer cloud storage services you do not use.
What this means for your company
Your business is unlikely to be the target of a state-backed espionage campaign, but the tools and gaps these groups use tend to spread. The lesson is that some patches come with homework. Ask whoever manages your Windows devices whether the Secure Boot revocation steps have been completed and how they verify it, and keep a short list of updates in your environment that require manual follow-up. Pair that with limited admin rights and monitored endpoint protection, so an attacker has to beat several defenses, not one.
Need help confirming your Windows fleet has finished the Secure Boot steps that updates alone do not complete? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
