BlackX bootkit bypasses Secure Boot on patched Windows systems
Kaspersky says BlackX was used in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, exploiting the Baton Drop flaw to bypass Secure Boot. The affected computers had Windows updates installed, but the required certificate revocation had not been activated manually; Kaspersky attributes the campaign to APT41 with medium confidence.
Bottom line — Installing the Windows update alone did not block BlackX: the Windows Production PCA 2011 certificate also had to be revoked.
Go deeper 6
-
Kaspersky says attackers first compromised victim networks and gained administrator privileges before installing BlackX.
-
The bootkit resembles BlackLotus, which also exploited Baton Drop; Kaspersky says BlackX’s developers may have reverse-engineered or obtained its source code.
-
BlackX installs custom Machine Owner Keys to load unauthorised EFI files and a kernel driver that attempts to interfere with security monitoring.
-
Kaspersky observed a remote-access trojan using Google Drive, OneDrive and Yandex.Disk for command communications, plus a second payload called OxiDLLRunner.
-
Kaspersky says some driver routines targeting its own products and Avast were ineffective in testing.
-
The Windows Production PCA 2011 certificate expired on 19 October 2026, but Kaspersky says expiration alone does not block vulnerable boot components.