Kaspersky researchers found BlackX, malware that loads before Windows, in attacks against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Their technical report describes a bootkit installed after attackers had already compromised networks and obtained administrator privileges.

Bill Toulas’s October 24 report highlights the operational failure: the affected Windows machines had current patches, but administrators had not activated the additional boot revocations.

An existing foothold became harder to remove

BlackX exploits Baton Drop, CVE-2022-21894, to bypass Secure Boot, the firmware check that limits which software can start the operating system. It installs attacker-controlled boot components and loads a malicious Windows kernel driver. The driver attempts to interfere with security monitoring and deploys espionage payloads.

Exploitation status: source-reported attacks in real organizations. Kaspersky says it discovered the campaign in early 2026. This is a newly reported investigation of earlier activity, not evidence that a new remote-entry vulnerability appeared today.

The researchers attribute the campaign to APT41 with medium confidence. Their evidence includes shared identifiers and similarities to previously reported tooling. That attribution remains an assessment, and the report supplies no reliable victim total.

The administrator-access prerequisite matters. BlackX adds persistence and weakens defenses on an already-compromised machine; the report does not describe unauthenticated internet access as sufficient to install it.

Installing an update and revoking old boot software are separate steps

Secure Boot can still trust an older, vulnerable boot manager when its signing certificate remains allowed. Replacing the current Windows files leaves that older trust path available unless the relevant revocation is applied.

Microsoft’s current KB5025885 guidance covers the related BlackLotus mitigation program under CVE-2023-24932. It says current Windows security updates include mitigations that are not enabled by default. Its automatic enforcement phase still has no announced date.

The sequence matters: establish trust in the Windows UEFI CA 2023 certificate, verify the updated boot manager, prepare compatible recovery media, then apply and verify revocation. Microsoft also documents a firmware version counter that prevents rollback to older boot managers.

This is a firmware-trust deployment problem, so a single Windows version number cannot establish that a machine has completed the protection.

Verify protection without breaking recovery

  • Install current Windows security updates and applicable firmware updates. Check Microsoft’s known issues for the actual device class before enabling revocations.
  • Evaluate the documented mitigations on representative devices first. Microsoft’s guidance separates certificate deployment, boot-manager verification, revocation and rollback protection.
  • Prepare updated recovery and installation media before revoking old certificates. Include network boot services and multi-Windows boot configurations in the plan. Old media can stop working afterward.
  • Ensure BitLocker recovery keys are backed up through the organization’s established process. Firmware changes can trigger recovery; keys should remain in approved storage.
  • Verify the resulting firmware state and documented success events. Microsoft identifies event 1037 for the revocation that distrusts the 2011 signing certificate. An installed update alone is insufficient evidence.
  • Handle suspected infection as an incident. Microsoft explicitly describes these mitigations as preventive, not corrective. Applying revocations does not establish that an already-compromised device is clean.

Microsoft warns that disk reformatting does not remove applied firmware revocations. Follow the current supported process rather than copying isolated registry commands from an older article.

Caveat: Kaspersky sells endpoint protection and supplies the campaign evidence; BleepingComputer’s account relies on that research, rather than independently confirming the victims.