Diplomatic missions in three Central Asian states spent early 2026 carrying an implant that ran before Windows did. Kaspersky calls it BlackX, a bootkit it ties to APT41, and the hosts it commands had already received every Secure Boot update Microsoft shipped.
The gap is administrative. BlackX abuses CVE-2022-21894, the Baton Drop bypass patched in 2023. Microsoft’s remedy came in two parts: a software update plus a manual step adding the Windows Production PCA 2011 certificate to the Secure Boot forbidden list. Few organizations completed the second half.
That certificate expired on October 19, 2026, and expiry alone does nothing – the vulnerable loaders keep working until the certificate is explicitly blocklisted. The operators plainly knew the remediation was mostly skipped.
Reusing a bootkit nobody published
BlackX loads through an installer dropped into C:\ProgramData\Intel, launched with an RC4 key that decrypts a payload and writes files to the UEFI partition. It installs Machine Owner Keys so arbitrary EFI binaries load, mirroring BlackLotus closely.
BlackLotus source code was never released, so the authors either reverse engineered it or bought it – striking, since APT crews seldom lift tooling from criminal markets.
What the driver does after boot
The kernel driver is signed with a certificate belonging to a Chinese technology studio, since revoked, and behaves like a vulnerable-driver attack. It tampers with endpoint security, some routines triggering only when Kaspersky or Avast software is present, though Kaspersky found the interference ineffective.
Two payloads follow: a remote access trojan hiding command traffic in Google Drive, OneDrive and Yandex.Disk, and a file stealer.
What defenders should do
Blocklist the PCA 2011 certificate in DBX, then hunt for unsigned EFI binaries and Machine Owner Keys your fleet tooling did not enroll. Patch status alone will not detect this.
