> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# BlackX Bootkit Beats Secure Boot on Patched PCs
- URL: https://blog.harshkohli.com/blackx-uefi-bootkit-secure-boot-bypass/
- Published: 2026-10-24T10:59:10.000Z
- Updated: 2026-10-25T07:39:05.000Z
- Description: Kaspersky's BlackX bootkit bypasses Secure Boot on patched Windows PCs that never applied Microsoft's revocation. How to check yours.
- Author: Harsh Kohli
- Tags: Tech News, Software

Here's a security story with an annoying twist: the PCs that got infected were fully patched. Kaspersky has found a new UEFI bootkit called BlackX that gets past Secure Boot on Windows machines that installed Microsoft's fix but never switched it on. I spotted it through [The Hacker News on X](https://x.com/TheHackersNews/status/2113704852148924776?ref=blog.harshkohli.com) and went straight to Kaspersky's write-up.

## What happened

In a [Securelist report](https://securelist.com/uefi-bootkit-blackx/121539/?ref=blog.harshkohli.com) published October 22, Kaspersky says BlackX hit diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026\. It attributes the campaign to APT41 with medium confidence. BlackX is closely modelled on BlackLotus, the bootkit sold on hacking forums back in 2022, and it abuses the same old Secure Boot flaw, Baton Drop (CVE-2022-21894).

Once installed, it loads a malicious driver at boot that tampers with security software and protects its own files, then drops spying tools. One of those uses Google Drive, OneDrive or Yandex.Disk to talk to its operators. The attackers only installed it after they already had admin rights on the network, so this is about staying hidden, not breaking in.

The catch is Microsoft's patch. The fix for this class of bypass ([CVE-2023-24932, KB5025885](https://support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d?ref=blog.harshkohli.com)) ships in Windows updates, but the important part, revoking the old "Windows Production PCA 2011" certificate, is off by default. Microsoft's own page says the automatic Enforcement Phase still has no date. Kaspersky also points out that the certificate expired on October 19, 2026, which doesn't block anything unless it's on the revocation list.

## Why it matters

Most admins, and nearly every home user, install updates and move on. Nobody expects a patch to need a registry change and a scheduled task before it actually protects you. A bootkit sits below Windows, so it survives reinstalls and can blind antivirus. Home PCs aren't the target here, but the gap is the same on every Windows machine that hasn't had the revocation applied.

## What to do

- Install the latest Windows updates first. That's the baseline either way.
- To check if the revocation is already in place, run this in an admin PowerShell window. `True` means it's applied:  
`[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'`
- If you manage PCs, follow Microsoft's KB5025885 steps on one device per model before rolling out. Microsoft warns the change can't be undone while Secure Boot is on, old recovery or install media may stop booting, and some firmware fails the update.
- Back up your BitLocker key before touching any of this, because Microsoft says some devices drop into BitLocker recovery. My guide on [finding your BitLocker recovery key](https://blog.harshkohli.com/find-bitlocker-recovery-key/) walks through where it's stored.

For a single home PC, I wouldn't rush the manual revocation without a recovery key and fresh install media on hand. Organizations with sensitive data should put it on this month's list.