Kaspersky reported that BlackX, a UEFI bootkit, was used in an early-2026 campaign targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The attackers deployed it after compromising networks and gaining administrator privileges. Kaspersky also says installing Windows updates does not necessarily activate the separate Secure Boot revocation intended to block vulnerable boot managers.
Why installing updates may not complete the revocation
Windows updates and revoking trust in vulnerable boot software are separate actions in Kaspersky’s account. The company says the affected machines had relevant updates installed, but the additional revocation was not necessarily activated. Its report describes activation involving a registry flag and a scheduled task named Secure-Boot-Update.
That distinction matters because a boot manager can be patched while the separate revocation has not taken effect. Secure Boot checks trusted software during startup; Baton Drop, tracked as CVE-2022-21894, is a logic flaw in the Windows boot manager that BlackX exploits to undermine those protections.
Microsoft says the Windows Production PCA 2011 certificate expired on October 19, 2026, and that its expiration alone does not prevent Windows devices from starting. Kaspersky says expiration alone also does not block vulnerable binaries unless the certificate is placed on the blocklist. Microsoft’s October 2026 guidance says personal devices receiving Microsoft-managed updates do not need to take the actions described in that article. That guidance concerns certificate and bootloader updates; it is a separate matter from the Baton Drop revocation Kaspersky describes.
What Kaspersky says BlackX does
Kaspersky describes BlackX as a UEFI bootkit similar to BlackLotus, though the two differ in exploit implementation and drivers. Its report says BlackX uses Baton Drop and installs custom Machine Owner Keys, which allow attacker-controlled EFI files to load.
Kaspersky also describes a kernel driver that interferes with process, thread and registry callbacks used by security products and tampers with Event Tracing for Windows (ETW) providers. The report describes additional payloads, including a remote-access trojan that used Google Drive, OneDrive or Yandex.Disk for command-and-control, and a separate payload that decrypted a Rust implant. These are components Kaspersky observed in its analysis of the campaign.
Kaspersky assessed a possible connection to APT41 with medium confidence. The assessment is not a definitive identification of the campaign’s operator.
