Kaspersky reports a new UEFI bootkit called BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. The company suspects the China-linked group APT41. BlackX is assessed to be an updated take on BlackLotus, the bootkit that exploits the Secure Boot bypass known as Baton Drop (CVE-2022-21894) to run code before Windows starts. Kaspersky’s finding is that the targeted machines were fully patched, and the problem was the patch itself.
According to Kaspersky, the Baton Drop fix only takes effect once the “Windows Production PCA 2011” certificate is revoked, and that does not happen automatically when the update is installed. An administrator has to set a registry flag under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot and a scheduled task named Secure-Boot-Update has to run. Kaspersky says the steps are buried deep on Microsoft’s site and that Microsoft’s planned automatic “Enforcement Phase” had not been implemented at the time of publishing. The certificate expired on October 19, 2026, but expiry alone does not stop the vulnerable binaries from loading unless the certificate is blocklisted. Attackers used BlackX after already gaining administrator privileges by an unspecified method; Microsoft has described such bootkits as a persistence and defense-evasion mechanism, not an initial access vector.
Once installed, the bootkit enrolls Machine Owner Keys to load arbitrary EFI files, then loads a kernel driver that tampers with security software and drops espionage payloads: a remote access trojan that uses Google Drive, OneDrive and Yandex.Disk for command and control, and a DLL (OxiDLLRunner) side-loaded by a legitimate googleupdate.exe. Kaspersky links the activity to APT41 through a June 2026 ESET report on FishMonger and through DLL side-loading; it notes that BlackLotus’s source code was never public, so BlackX’s authors either reverse-engineered it or obtained the code.
How to check if you’re affected
Affected devices are Windows systems that have the Baton Drop patches for CVE-2022-21894 installed but have not had the Windows Production PCA 2011 revocation applied. Check Microsoft’s guidance on managing the Windows boot manager revocations and confirm, device by device, whether the revocation steps were completed after patching rather than assuming the update did it.
- Kaspersky warns that automatic revocation could break dual-boot systems that rely on the PCA 2011 certificate to load, which is why Microsoft made the step manual. Testing before a broad rollout is our suggestion, not Kaspersky’s.
- Indicators described in The Hacker News coverage of the report include an installer at
C:\ProgramData\Intel\inst.exewith an encrypted file named PVMDIJGKAX2, a kernel driver signed under the name Wenjiang District Mingyu Network Technology Service Studio (since revoked), and traffic to archivetj[.]com. - Because BlackX needs administrator access first, review how any such access could have been obtained on high-value machines.
Sources
- Kaspersky Securelist: How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
- Microsoft: Guidance for investigating attacks using CVE-2022-21894 (BlackLotus campaign)
- Microsoft Security Response Center: CVE-2022-21894
- The Hacker News: BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations