BlackX Bootkit Secure Boot Bypass Explained: How Patched Windows PCs Were Still Exposed (World Tech)

Illustrative image: a computer motherboard. BlackX is malware, not a product, so no product photo exists — this is the hardware layer whose boot firmware BlackX subverts. Image: Wikimedia Commons

TL;DR: BlackX bootkit secure boot bypass explained: Kaspersky's newly detailed BlackX malware slips past Secure Boot on fully patched Windows PCs by abusing a 2022 flaw, Baton Drop, whose fix only works if administrators finish a manual step many skipped. It hit diplomatic targets, not home users — but the lesson applies to every Windows admin.

📌 KEY HIGHLIGHTS

• What it is: BlackX, a UEFI bootkit found by Kaspersky in early 2026, loads before Windows and survives reboots, reinstalls and most antivirus scans.
• The twist: the victims' PCs were fully patched. The Baton Drop fix (CVE-2022-21894) needs manual activation — a registry flag and a scheduled task — and without it, the patch alone does not protect you.
• Who was hit: diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan, in a campaign Kaspersky attributes to APT41 with medium confidence.
• What it does: installs its own trusted boot keys, injects a malicious driver into the Windows kernel, and spies via cloud-storage channels.
• Home-user risk: low — this is targeted espionage that first needs administrator access. The fix checklist below still matters for every Windows machine.

What happened?

Kaspersky's Global Research and Analysis Team (GReAT) uncovered BlackX while investigating an attack on diplomatic organisations in Central Asia in early 2026. The company published its full technical analysis on 22 October 2026 and presented it at the Security Analyst Summit 2026 in Bali; BleepingComputer and other security outlets covered it through 24 October.

BlackX is a modernised successor to BlackLotus, the notorious bootkit first advertised on a hacking forum in October 2022 for about $5,000 and confirmed by ESET in March 2023. Kaspersky found BlackX's exploit code "remarkably similar" to BlackLotus's — yet BlackX contains code missing from the BlackLotus source that leaked in July 2023, so the researchers believe its operators either reverse-engineered BlackLotus or bought its unpublished source code.

BlackX bootkit secure boot bypass explained: one old flaw, one skipped step

Secure Boot is supposed to guarantee that only software signed by trusted keys runs when a PC starts. BlackX breaks that guarantee with Baton Drop, tracked as CVE-2022-21894: a Secure Boot bypass in Windows boot components signed with the 'Windows Production PCA 2011' certificate.

Here is the part that should worry administrators. Microsoft patched Baton Drop — but the patch does not finish the job by itself. Fully activating the protection requires a manual step: setting a Secure Boot registry flag and running the Secure-Boot-Update scheduled task. As of Kaspersky's report, Microsoft's automatic Enforcement Phase had not been implemented, so vulnerable boot components stayed trusted on machines where nobody completed the manual step. The compromised machines in this campaign were fully patched — and still exploitable.

BlackX also needs a head start: attackers deploy it only after they have already broken into a network and gained administrator rights. The installer, inst.exe, works with an RC4-encrypted file named PVMDIJGKAX2 that holds the installation components — keeping them out of the installer itself makes the full package harder for responders to recover. It then plants files on the system and EFI partitions and enrols attacker-controlled Machine Owner Keys (MOKs), so the machine happily loads the attackers' EFI files at every boot.

Illustrative image: a Windows laptop. BlackX runs before Windows loads, so it sits beneath everything most security software can see. Image: Wikimedia Commons

What BlackX does once it is in

Because it loads before Windows, BlackX can inject a malicious driver into the Windows kernel. That driver tries to switch off the callbacks security tools rely on and to interfere with Event Tracing for Windows — the logging that defenders use to spot intrusions. Kaspersky notes that, in its testing, the targeted routines failed to disrupt Kaspersky products. The driver also hides its files in a brazen way: if anything tries to open them, it hands back a handle to calc.exe, Windows Calculator, instead.

Payload	How it works	Why it is hard to spot
Cloud-storage remote access trojan	Takes orders and moves files through Google Drive, OneDrive or Yandex.Disk	Looks like ordinary document syncing to a firewall
OxiDLLRunner loader	Sideloaded through legitimate googleupdate.exe; decrypts v8_context_snapshot.bin into a Rust implant contacting archivetj.com	Hides behind a trusted Google updater process; loads extra DLL plugins on demand

The Rust implant can receive DLL plugins that export a function called create_plugin and run them in separate threads — a modular spy toolkit, not a one-shot infection. The driver signing certificate has since been revoked, which closes one door, but revocation only helps machines that actually enforce the updated revocation list.

Why it matters for World Tech readers — including India

No India-specific victims have been reported, and ordinary users are not the target: BlackX is espionage tooling aimed at diplomatic networks, and it needs administrator access before it can even install. But the underlying failure is universal. India runs one of the world's largest Windows estates — government offices, banks, universities and small businesses — and the same skipped manual step leaves any of them in the same position as the Central Asian victims: patched, yet still trusting vulnerable boot code.

It also belongs to a pattern TechByCountry readers have seen all month: the k0t firewall credential-theft campaign and the actively exploited Collabora and Arista flaws added to CISA's KEV list both show attackers living off configuration gaps rather than brand-new bugs. The fix is rarely just "update" — it is update plus the follow-through. The same lesson ran through our PHP2Shell patch guide: patches only protect machines whose owners actually finish the job.

Should you care?

✅ Yes — if you administer Windows machines: check the Secure Boot revocation step today; a patched machine without it is still exposed to Baton Drop. ⏳ Stay calm — if you are a home user: BlackX targets diplomatic networks and needs admin access first, so your risk is low. 🔍 The real takeaway: "fully patched" is not the same as "fully protected" — verify the protection actually activated.

What to check today

Check	Action
Windows updates	Install all current Windows updates — the revocation tools only exist on updated systems.
Secure Boot revocation (CVE-2022-21894)	Follow Microsoft's guidance: set the registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and run the Secure-Boot-Update scheduled task. Test dual-boot machines first.
Admin rights	BlackX only lands after attackers own an admin account — keep admin accounts few and separate from daily-use accounts.
Cloud-storage traffic	Unexpected Google Drive or OneDrive activity from a server deserves a second look — it is how BlackX's trojan talks home.

FAQs

What is the BlackX bootkit?
BlackX is a UEFI bootkit discovered by Kaspersky in early 2026. It infects a PC's boot firmware so its malware loads before Windows starts, giving it deep persistence and a view of the system that most security software cannot match. It was used against diplomatic organisations in Central Asia.

Does BlackX affect ordinary home users?
Almost certainly not directly. BlackX is targeted espionage malware that first requires attackers to compromise a network and gain administrator rights. Home users face a low risk, but the protection lesson — verifying that security updates actually activated — applies to everyone.

What is the Baton Drop flaw?
Baton Drop, tracked as CVE-2022-21894, is a Secure Boot security-feature bypass in Windows boot components signed with the 'Windows Production PCA 2011' certificate. Microsoft issued a fix, but the fix needs manual activation; without that step, vulnerable boot components remain trusted even on patched systems.

How do I check whether my PC is protected?
Install current Windows updates, then confirm the Secure Boot revocation step from Microsoft's CVE-2022-21894 guidance has been applied — the registry flag and the Secure-Boot-Update task — especially on managed or dual-boot machines, where you should test before rolling out widely.

Takeaway: BlackX proves the scariest sentence in security is "but we patched." A patch that nobody finishes activating is a door left open — and BlackX walked through it on fully updated machines.

Follow World Tech on TechByCountry for tomorrow's 6 PM update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

Kaspersky — Beneath the operating system: Kaspersky discovers BlackX bootkit targeting diplomatic organizations in Central Asia
BleepingComputer — BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
CyberPress — New BlackX UEFI Bootkit Bypasses Windows Secure Boot Even After Security Updates