BlackX: Kaspersky finds a BlackLotus-style UEFI bootkit on fully patched Windows machines of Central Asian diplomatic bodies, because the Baton Drop fix does not revoke the old boot-manager certificate until an administrator triggers it

Kaspersky GReAT reports that in early 2026 it found BlackX, a UEFI bootkit similar to BlackLotus, used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan after the attackers held administrator privileges: an installer takes an RC4-encrypted package and its key as command-line arguments and drops files to the system and UEFI partitions that exploit Baton Drop (CVE-2022-21894) to enrol attacker-controlled Machine Owner Keys, so arbitrary EFI files load despite Secure Boot (Kaspersky GReAT, 2026-10-22). Kaspersky ties the exploitation to Baton Drop alone; CVE-2023-24932, the flaw Microsoft's revocation guidance is titled for, appears in its post only as the one a UEFI component in ESET's FishMonger report might exploit (Kaspersky GReAT, 2026-10-22). The bootkit injects a kernel driver, signed with a certificate its issuer has since revoked, that disables process, thread and registry callbacks and ETW providers of security products; the user-mode payloads were a RAT that uses Google Drive, OneDrive or Yandex.Disk for command and control and a sideloaded loader (Kaspersky GReAT, 2026-10-22).

The targeted machines were fully patched. Microsoft's fix revokes the Windows Production PCA 2011 certificate only when an administrator sets a Secure Boot registry flag and runs the Secure-Boot-Update scheduled task (Kaspersky GReAT, 2026-10-22); Microsoft's own article says the mitigations in the updates of 2024-07-09 and later are not enabled by default and the Enforcement Phase date is still to be announced (Microsoft Support, 2026-09-30), and Kaspersky says that phase has not been implemented and the certificate's expiry on 2026-10-19 does not stop the vulnerable binaries loading unless it is on the forbidden list (Kaspersky GReAT, 2026-10-22). Kaspersky attributes the campaign to APT41 with medium confidence, resting on the identifier "xdd" shared with a kernel implant in ESET's June 2026 FishMonger report, DLL sideloading and OLLVM (Kaspersky GReAT, 2026-10-22).