What the BlackX bootkit means for patched Windows PCs

Kaspersky researchers found a new UEFI bootkit called BlackX in an espionage campaign in early 2026, according to BleepingComputer. BlackX got past Secure Boot using Baton Drop (CVE-2022-21894), a Windows flaw from 2022. The detail that matters for you: Kaspersky says every victim ran a fully patched Windows release. The fix only works if an admin also triggers the revocation of the Windows Production PCA 2011 certificate by hand.

The background you need

UEFI is the firmware that starts your PC before Windows loads. It replaced the old BIOS. Secure Boot is a UEFI feature that refuses to run boot code unless it carries a trusted digital signature. The firmware keeps two lists. The allow list (called db) holds trusted certificates. The deny list (called dbx) holds certificates and files that must be rejected.

A certificate here works like a signing stamp. Microsoft signs Windows boot components with a certificate the firmware trusts. If the firmware trusts the certificate, it trusts everything signed with it.

A bootkit is malware that runs during startup, before Windows and your security software load. That makes it very hard to see from inside the operating system.

Baton Drop is a flaw in signed Windows boot components that lets an attacker get around Secure Boot checks. Patching the flaw gives you fixed components. But the old, vulnerable copies still carry a valid signature, so an attacker can bring an old copy and the firmware will still run it. That is why the fix also needs to revoke the certificate that signed the vulnerable components. Revoking means telling the firmware to stop trusting it.

Here is an analogy. A venue’s bouncer lets in anyone with a wristband from a trusted printer. You fix a broken side door, but an intruder shows up with an old wristband from the same printer, and the bouncer waves them in. The real fix is telling the bouncer to reject that whole batch of wristbands.

The analogy breaks in one place. Rejecting the batch also rejects legitimate items signed with the same certificate. That can include older boot or recovery media. So revocation has side effects, and it needs to be tested.

A few more terms:

• BlackLotus is an earlier bootkit. According to BleepingComputer, it has circulated on hacker forums since October 2022. ESET confirmed in March 2023 that it exploited Baton Drop and could compromise even fully patched Windows 11 systems at the time. Its source code leaked in July 2023, but the leak was incomplete.
• Machine Owner Keys (MOKs) let a machine’s owner enroll their own signing keys, so the firmware trusts boot code they choose.
• Event Tracing for Windows (ETW) is a built-in Windows logging system that security tools rely on to watch what happens on a machine.

What actually changed

The vulnerability, the patch, and the manual revocation step are not new. What is new is a fresh bootkit that exploits that gap in a real campaign.

According to BleepingComputer, the operation has been attributed with medium confidence to APT41. APT41 is a Chinese state-sponsored group also known as Brass Typhoon, Wicked Panda, and Barium. The campaign targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.

Kaspersky describes BlackX’s exploit as “remarkably similar” to BlackLotus. It enrolls attacker-controlled MOKs and loads arbitrary EFI files, which are UEFI programs. BlackX uses a different kernel driver and different follow-on payloads, though. Some BlackLotus samples Kaspersky analyzed contained code that is missing from the leaked repository but present in BlackX. So the researchers believe the attacker either reverse-engineered BlackLotus or bought its source code.

The driver is signed with a now-revoked certificate issued to Wenjiang District Mingyu Network Technology Service Studio. According to Kaspersky, it does several things:

• It disables security-related processes and registry callbacks.
• It tampers with ETW providers to obstruct monitoring.
• It hides the bootkit’s files. If a user tries to open them, it launches Windows Calculator instead.
• It deploys espionage payloads.

Some tampering steps run only when Kaspersky or Avast products are detected. The researchers say the mechanism is useless against the company’s solutions.

What it means for developers and IT staff

The core lesson is that patch status alone does not tell you whether you are protected. Kaspersky puts it plainly: “However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually.”

Kaspersky calls this a gap in the update process. Its reasoning is that admins very rarely take manual action after applying a security update. The researchers believe the attacker chose to copy BlackLotus because of this gap.

A patched machine without the revocation still trusts the vulnerable boot components. That is the condition Kaspersky found on BlackX victims.

The certificate’s expiration date does not close the gap either. Kaspersky warns that the October 19, 2026 expiration date of Windows Production PCA 2011 does not stop the vulnerable binaries from loading. They still load unless admins add the certificate to a blocklist. Do not wait for the date to fix things for you.

What to do:

1. List the affected machines. Find the Windows machines in your fleet with Secure Boot enabled.
2. Check the revocation. For each one, check whether the PCA 2011 revocation was actually applied. Do not rely on update compliance alone.
3. Follow the full instructions. BleepingComputer’s article links to instructions to fully patch Baton Drop. Use those instructions for the exact steps.
4. Test first. Try the change on a small group of machines before a broad rollout. Revocation can stop older boot and recovery media from working.

What we don’t know yet

• How many organizations were hit. The report names target countries and sectors but gives no victim count.
• How attackers got in. The report does not explain how they gained access before installing the bootkit.
• Whether BlackX has spread. It is unclear whether it is used outside the Central Asian diplomatic targets.
• Why the revocation is manual. The sources do not say why this step is not automatic.
• Whether automatic updates now cover it. A commenter on BleepingComputer’s article claims Microsoft’s automatic Secure Boot certificate updates do not include the needed revocation. That is a reader comment, not a confirmed finding.
• How solid the attribution is. The link to APT41 is rated medium confidence only.