Patched in 2022, a Windows boot flaw is still being used to spy on diplomats

To hide its files, the program uses a almost comical trick: anyone who tries to open them lands on the Windows calculator. Behind this diversion lies far less amusing malware, lodged in the very first stage of the computer's startup, before Windows itself.

On October 22, three Kaspersky researchers, Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov, described BlackX. It is a UEFI "bootkit," meaning a program that installs itself in the machine's boot chain. It was used in early 2026 against diplomatic bodies in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky attributes it, with medium confidence, to the espionage group APT41, also known as Brass Typhoon or Wicked Panda. The point that should alert IT departments: according to Kaspersky, all the victims had up-to-date Windows.

How could an up-to-date PC be hacked at startup?

BlackX exploits Baton Drop (CVE-2022-21894), a Windows boot manager vulnerability patched in January 2022 and already used by the BlackLotus bootkit. It makes it possible to bypass Secure Boot, which is meant to prevent unauthorized components from loading. The attackers enroll their own keys, "Machine Owner Keys," to then launch the files of their choice.

Why wasn't the patch enough? Because it does not remove the trust granted to older vulnerable boot managers, signed with the "Windows Production PCA 2011" certificate. This revocation "is not done automatically when the patch is installed," Kaspersky writes: the administrator has to trigger it. The certificate expired on October 19, 2026, but, the researchers warn, that does not stop the vulnerable files from loading as long as it is not blocklisted. Microsoft plans an automatic enforcement phase, the date of which has still not been announced.

Kaspersky considers the exploit "remarkably similar" to BlackLotus's and believes its author either analyzed BlackLotus in detail or obtained its source code. Once in place, BlackX loads a driver signed with a revoked certificate, which disables mechanisms used by security software. One part specifically targets Kaspersky and Avast, with no effect on Kaspersky products according to the vendor. Next come a remote access tool, which communicates through Google Drive, OneDrive or Yandex.Disk, and a module loader named OxiDLLRunner.

What administrators can do right now

To install BlackX, the attackers had already obtained administrator rights. Revocation therefore does not repair an intrusion, but it closes a door that lets an attacker take root under Windows, out of reach of security tools. Microsoft describes it in its article KB5025885, updated on September 30, 2026:

• first update the database of allowed certificates, then revoke "Windows Production PCA 2011" in the revocation list (DBX), using the AvailableUpdates registry value and the Secure-Boot-Update scheduled task;
• test on one device of each model before rolling out widely: Microsoft reports firmware that refuses the update, and known issues with VMware virtual machines, some HP PCs, or Symantec Endpoint Encryption;
• back up your BitLocker recovery keys and rebuild your boot and reinstallation media, as the old ones may no longer boot;
• be aware that the operation is irreversible: once the revocation is applied with Secure Boot enabled, even reformatting the disk does not undo it.

Microsoft promises at least six months' notice before enforcing the revocation. How many other groups have also gotten hold of BlackLotus's code? Kaspersky doesn't say. But BlackX shows that a flaw patched almost five years ago remains exploitable until this last step is done.