BlackX bootkit bypassed Secure Boot on patched Windows systems
Kaspersky says BlackX was used in early-2026 espionage attacks against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The bootkit exploited the Baton Drop flaw even on fully patched machines because administrators had not completed the separate Secure Boot certificate revocation; Kaspersky attributes the campaign to APT41 with medium confidence.
Bottom line — Windows updates alone did not block BlackX: the Windows Production PCA 2011 certificate also had to be revoked.
Go deeper 6
-
Kaspersky found BlackX’s exploit method closely resembled that of the earlier BlackLotus bootkit.
-
The attackers first compromised victim networks and gained administrator privileges, Kaspersky reported.
-
BlackX loaded a kernel driver designed to interfere with security monitoring, including Event Tracing for Windows.
-
Kaspersky observed a remote-access trojan using Google Drive, OneDrive and Yandex.Disk for command-and-control.
-
Kaspersky said the Windows Production PCA 2011 certificate expired on 19 October 2026, but expiry alone did not block vulnerable boot files.
-
Microsoft’s planned automatic enforcement phase had not been implemented when Kaspersky published its findings.