New BlackX bootkit beats Secure Boot on fully patched Windows PCs: how to check yours

A new piece of malware shows how a Windows PC can have every security update installed and still be open to a boot-level attack. Kaspersky's researchers say the tool, which they call BlackX, exploited a 2022 flaw known as Baton Drop (CVE-2022-21894) to switch off Secure Boot protections on machines that were "fully patched." The reason, according to Kaspersky: installing the patch does not finish the job. A second, manual step has to be taken, and in these cases it had not been.

This was first published by Kaspersky in its Securelist report on October 22, and followed by BleepingComputer on October 24 and The Hacker News on October 23. The targets Kaspersky describes were diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026, not small companies. The lesson is still a practical one for any business that owns Windows PCs.

What BlackX does

A bootkit loads before Windows itself, which is why it can hide from security software that starts later. Secure Boot is the firmware feature meant to stop that by allowing only trusted, signed boot files. Baton Drop is a flaw in how an older, Microsoft-signed boot component is handled. Per The Hacker News, it carries a CVSS score of 4.4 and requires administrator privileges or physical access to exploit.

That matches Kaspersky's account of the attack: after the intruders had already obtained administrator rights, they dropped an installer and an encrypted file. The exploit then installs custom Machine Owner Keys, which lets the machine load files of the attacker's choosing. A malicious kernel driver follows. Kaspersky says it disables security-product callbacks, tampers with Windows event tracing and hides its own files, with some routines running only if Kaspersky or Avast products are installed. Later payloads included a remote access tool using Google Drive, OneDrive and Yandex.Disk for command and control.

Kaspersky says its implementation of the exploit is strikingly similar to BlackLotus, the bootkit that ESET documented in March 2023 and that was advertised on a hacking forum for $5,000 in October 2022. Because the BlackLotus source code was only partly leaked, Kaspersky concludes the BlackX author either reverse-engineered it or obtained fuller code.

Who is behind it: Kaspersky's hedged view

Kaspersky says it attributes the campaign to the Chinese-speaking group APT41 "with medium confidence." Its reasoning is circumstantial: a string, "xdd," that also appears in an ESET report from June 2026 on a group called FishMonger, plus DLL side-loading and code obfuscation habits common among Chinese-speaking actors. The Hacker News notes that ESET acknowledged the similarities but said it cannot confirm or rule out a connection without comparing samples. Treat the attribution as a researcher's assessment, not a finding. The Chronicle has not independently verified it, and the practical advice below does not depend on who is responsible.

Why a patched PC was still exposed

Kaspersky's central point is about the revoking of the "Windows Production PCA 2011" certificate, which signed the vulnerable boot components. In its words, the fix does not happen automatically on patch installation; the user has to trigger it. Microsoft has described a later "Enforcement Phase" that would revoke the certificate automatically, but Kaspersky says that stage had not been implemented as of publication.

The certificate itself expired on October 19, 2026. That changes less than it sounds: according to Kaspersky, expiry does not stop the vulnerable files from loading unless the certificate is also added to the blocklist (the "DBX").

How a small business can check its status

Microsoft's own guidance, in its Windows IT Pro blog post and support article KB5025885, gives read-only checks. Run the first two in PowerShell as administrator on a PC that boots with UEFI Secure Boot:

1. Is the revocation applied? Run [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'. Per KB5025885, True means PCA 2011 is in the blocklist. False means this PC has not had the revocation.
2. Is the prerequisite in place? Run [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Windows UEFI CA 2023'. Microsoft says True means the newer trust anchor has been added, which must come first.
3. Event log. KB5025885 lists Event ID 1037 as the sign that the revocation was applied.

If the PC shows False on the first check, do not simply force the update. Microsoft warns that applying the blocklist update without the new certificate in place bypasses safety checks and can leave a system unable to boot. After revocation, older Windows install media, recovery drives and network boot images signed with the 2011 certificate may stop working, and BitLocker can enter recovery mode. Microsoft also says revocations cannot be reversed while Secure Boot stays on. Its advice is to test on one machine of each type first, update firmware, and keep BitLocker recovery keys and a recovery drive in hand.

What this means for a business with a handful of PCs

• If you have an IT provider, send them the two checks above and ask for the results per machine, plus their plan and dates for the revocation.
• If you run the machines yourself, start with a single spare or low-risk PC, and record the BitLocker recovery key before touching anything.
• Remember the precondition. Baton Drop attacks in Kaspersky's report followed administrator access. Keeping admin rights scarce and using endpoint protection is still the first line, which Kaspersky also stresses.
• Indicators from Kaspersky's report include the file C:\ProgramData\Intel\inst.exe and the domain archivetj[.]com; its report lists more for security teams.

The Chronicle could not independently confirm that other outlets, including Ars Technica, had published on this story, and we did not rely on them. Everything above comes from the Kaspersky and Microsoft documents and the two outlets linked.

Sources: Kaspersky Securelist; Microsoft Windows IT Pro Blog and KB5025885; BleepingComputer; The Hacker News. This is general information, not IT or investment advice; test any firmware or boot change on a single device first.