UEFI bootkit infects patched Windows PCs
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Kaspersky found the BlackX UEFI bootkit infected fully patched Windows machines whose admins never triggered Secure Boot revocations.
The revocations Microsoft shipped don't apply on their own, leaving patched PCs exposed.
Background
BlackX is a UEFI bootkit — malware that runs early in the startup process, can be hard to detect without specialized tools, and may survive an OS reinstall if the infected boot partition stays intact. It exploits Baton Drop (CVE-2022-21894), a logic flaw in the Windows boot manager that Microsoft patched in 2022 but whose signing certificate it did not revoke. Kaspersky, the cybersecurity company that discovered the BlackX infections, says the patch is meant to revoke the older Windows Production PCA 2011 certificate, but that revocation only happens if an administrator triggers it manually. Microsoft held off enforcing revocations because devices lacking necessary updates could become unbootable, so most admins needed an extra step after patching.
How it unfolded
- 2022Microsoft patched the Baton Drop vulnerability (CVE-2022-21894) in the Windows boot manager but did not revoke trust in the certificate used to sign older vulnerable boot managers.
- Mar 2023ESET confirmed BlackLotus exploited Baton Drop and could compromise fully patched Windows 11 systems.
- May 2023Microsoft began a yearslong mitigation process, adding the Windows UEFI CA 2023 certificate to Secure Boot's trusted-certificate database.
- 2024Microsoft added a way to place the older Windows Production PCA 2011 certificate in Secure Boot's forbidden-signatures database, but the updates did not themselves revoke trust in the vulnerable boot managers.
- Oct 20, 2026Kaspersky's Securelist published analysis of BlackX, finding the targeted machines were fully patched and that the Baton Drop revocation must be triggered manually.
- Oct 23, 2026The Hacker News reported BlackX bypasses Secure Boot on patched Windows systems missing revocations; the malicious driver was signed with a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio, since revoked by the issuer.
- Oct 24, 2026BleepingComputer reported Kaspersky saying all BlackX victims used a fully patched Windows release but admins did not manually activate the additional Secure Boot revocations.
- Nov 3, 2026Ars Technica reported BlackX infected fully patched Windows machines, with organizations having installed all Microsoft patches.
Who’s saying what
- Expert
- Kaspersky says the Baton Drop patch is designed to revoke the Windows Production PCA 2011 certificate, but the revocation does not happen automatically — the user has to trigger it manually.
- Analysts
- A Kaspersky researcher says system administrators usually do not take additional actions after installing updates, while activation instructions sit deep within Microsoft's website.
- Caution
- Kaspersky says it initially thought attackers succeeded due to negligence of the target organizations, but its investigation proved the targeted machines were fully patched.
- Analysts
- Ars Technica frames BlackX as exploiting Microsoft's lack of clarity around Secure Boot protections.
Still unverified
Cybersecuritynews links the activity to APT41 with medium confidence, based on overlaps with previously reported activity and shared technical details; it describes that assessment as not definitive attribution.