A patched Windows PC is supposed to be a safe PC. A new report from Kaspersky explains why that is no longer true for thousands of machines. Researchers have uncovered a UEFI bootkit called BlackX that bypasses Microsoft’s Secure Boot protections even on systems that already have the patch installed. The trick is that most organisations never completed the second, manual half of Microsoft’s fix.
What Is the BlackX Bootkit?
BlackX is a UEFI bootkit. That means it infects the firmware layer that runs before Windows even starts. Because it loads before the operating system, it can hide from antivirus tools, survive a full Windows reinstall and keep control of the machine for a long time.
According to Kaspersky’s technical report published this week, BlackX is an updated version of BlackLotus, a bootkit that first appeared on cybercrime forums in late 2022 and was confirmed by ESET in March 2023. BlackLotus became famous for exploiting a Secure Boot bypass vulnerability known as CVE-2022-21894, also called Baton Drop.
What makes BlackX notable is that its creators clearly studied BlackLotus in depth. Kaspersky pointed out that the source code of BlackLotus never entered the public domain, which means the BlackX team either reverse-engineered the original bootkit or bought its source code. The researchers noted that it is rare to see state-sponsored groups borrow ideas or code from ordinary cybercrime actors.
Who Is Behind the Attacks?
The campaign targeted diplomatic organisations in Central Asia, specifically in Tajikistan, Uzbekistan and Turkmenistan, in early 2026. Kaspersky suspects the operation is the work of APT41, a China-linked state-sponsored hacking group.
The goal of the operation was not quick financial gain. The attackers wanted to undermine Microsoft Windows startup defences and third-party security tools while keeping long-term, covert access to the compromised devices. That profile fits espionage rather than ransomware.
How the Attack Works
BlackX does not break into a network by itself. The attackers first breach a victim’s network through some other method and gain administrator privileges. That part matters, because CVE-2022-21894 cannot be exploited by a standard user account. As Microsoft noted when the flaw first appeared, a bootkit like this is a persistence and defence evasion tool, not an initial access vector. The attacker needs admin rights or physical access to the machine.
Once inside, the attackers drop two files: an installer called inst.exe and an encrypted, extensionless file named PVMDIJGKAX2 that carries the files and strings needed for installation. The installer is launched from the command line with an RC4 key used for decryption. It then copies files to both the system and UEFI partitions to exploit CVE-2022-21894 in a way that Kaspersky describes as remarkably similar to BlackLotus.
The end goal is to install Machine Owner Keys, or MOKs, which let the attacker load arbitrary EFI files on the infected host and interfere with Secure Boot. After that, a UEFI payload injects a malicious driver into the Windows kernel. In the samples Kaspersky analysed, the driver was signed with a certificate belonging to a company named Wenjiang District Mingyu Network Technology Service Studio. That certificate has since been revoked.
Why Patched Systems Are Still at Risk
This is the part of the story that should concern every IT team. CVE-2022-21894 was patched by Microsoft back in 2022. But completely addressing the Baton Drop flaw requires more than installing the update. Organisations also had to run manual steps to apply the Secure Boot revocation mitigations, including adding the “Windows Production PCA 2011” certificate to the Secure Boot UEFI Forbidden List, known as the DBX.
Kaspersky found that attackers are capitalising on the fact that very few organisations carried out those manual steps. That gap lets them use the old Baton Drop vulnerability even on machines that show the patch as applied.
There is another date worth remembering. On 19 October 2026, the Windows Production PCA 2011 certificate expired. You might think an expired certificate would block the attack. It does not. As Kaspersky researchers Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov explained, the expiry does not prevent vulnerable binaries from loading unless the certificate is actually blocklisted in the DBX.
The researchers believe the threat actor counted on the fact that few organisations understood the importance of manually activating the Baton Drop patch, and invested the time to build a copycat bootkit around that gap.
The BlackLotus Timeline
Understanding how BlackX arrived helps explain why the current problem exists. BlackLotus first appeared on cybercrime forums in late 2022 as a product anyone could buy. ESET confirmed its existence in March 2023 and documented how it abused CVE-2022-21894 to load before Windows. Microsoft patched the vulnerability in 2022 and published guidance showing that full protection also required the manual DBX revocation step.
For a while, BlackLotus activity faded as the community tracked its builders. The bootkit’s source code never leaked publicly. Kaspersky’s new research shows that the gap it left was an opportunity. Someone studied the old tool closely enough to rebuild its capability, then pointed it at Central Asian diplomatic targets in early 2026. Old attack knowledge does not expire, and neither does an unfinished patch.
How to Protect Your Systems
The good news is that the attack needs admin or physical access, and there are clear defensive steps.
- Apply the DBX revocation updates. Installing the Windows update is not enough. Follow Microsoft’s Secure Boot revocation guidance and make sure the Windows Production PCA 2011 certificate is in the UEFI Forbidden List. Microsoft has shipped revocation packages through Windows Update and standalone tooling for exactly this purpose.
- Check your firmware and Secure Boot state. Use your firmware settings and Windows system information tools to confirm Secure Boot is enabled and the DBX is current on every machine.
- Watch for the installer artifacts. Kaspersky’s report names the dropped files, inst.exe and the extensionless PVMDIJGKAX2 file in ProgramData, along with the suspicious command line pattern. Add these to your endpoint detection rules.
- Audit Machine Owner Keys. Unfamiliar MOKs on business machines are a red flag. Firmware-level persistence also calls for a full firmware reflash from clean vendor images when you clean a machine.
- Treat admin credentials as crown jewels. Since the bootkit needs administrator privileges, phishing-resistant multi-factor authentication and privilege tiering cut off the entry path.
- Enable hardware-backed boot protections. Features like virtualisation-based security and measured boot raise the cost of this class of attack.
The certificate used to sign the malicious driver is already revoked, and the wider lesson from the BlackLotus era still applies: firmware-level attacks thrive on neglected maintenance steps. A patch that is installed but not fully activated is an open door.
Frequently Asked Questions
What is the BlackX UEFI bootkit?
BlackX is a UEFI bootkit that bypasses Microsoft’s Secure Boot protections by exploiting CVE-2022-21894 (Baton Drop), even on systems where the patch is installed but the manual revocation steps were never applied. Kaspersky reports that it is an updated copy of the BlackLotus bootkit and was used against diplomatic organisations in Central Asia.
Which computers are affected by BlackX?
Windows machines where the 2022 Secure Boot patch was installed but the Windows Production PCA 2011 certificate was never added to the Secure Boot UEFI Forbidden List (DBX) are at risk. The attack also requires the attacker to already have administrator privileges or physical access to the device.
How do I protect my PC from the BlackX bootkit?
Apply Microsoft’s Secure Boot revocation updates so the DBX is current, keep Secure Boot enabled, monitor for the inst.exe installer artifacts described in Kaspersky’s report and treat administrator credentials with strict access controls. These steps close the gap the attackers are using.
Is BlackX related to BlackLotus?
Yes. Kaspersky assesses BlackX as an updated version of BlackLotus, the bootkit first advertised on cybercrime forums in late 2022. The installation method is remarkably similar, although BlackLotus source code was never public, so the creators either reverse-engineered it or bought it.
