Why a patched PC still loaded the BlackX bootkit, and how to check yours

Kaspersky says it found BlackX, a UEFI bootkit, on fully patched computers at diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It links the operation to APT41 with medium confidence. Attackers first gained administrator access, then used Baton Drop (CVE-2022-21894), a Secure Boot bypass also used by BlackLotus, to install their own signing keys and load malicious EFI files. BlackX’s driver interferes with security tools and hides its files; the malware also installs remote-access and command-and-control tools. The central point is that installing Windows updates alone did not prevent the attack: Microsoft’s protection against the vulnerable boot files requires separately revoking the Windows Production PCA 2011 certificate, and that step remains off by default.

A PC can report that the newer 2023 certificate is installed while still trusting old PCA 2011-signed boot files. The guide recommends checking the firmware’s allowed and blocked certificate lists, the UEFICA2023Status registry value, and TPM-WMI events; a True result for the PCA 2011 check in the blocked list is the key confirmation. Microsoft’s prescribed sequence is to install current updates, add the 2023 certificate and boot manager using AvailableUpdates 0x5944, then apply the PCA 2011 revocation with 0x80, followed optionally by the boot-manager version minimum with 0x200. Before revocation, administrators should save BitLocker recovery keys, prepare recovery media, and test each PC model: the change cannot be undone while Secure Boot is enabled and may prevent older recovery, installation, network-boot media, or outdated Windows installations from starting.