A 2022 Secure Boot bug is still getting people owned in 2026. Kaspersky found BlackX, a UEFI bootkit used against diplomats in Central Asia (linked to APT41 with medium confidence). It abuses Baton Drop, CVE-2022-21894, the same trick as BlackLotus.
The uncomfortable part: the victims were patched. Microsoft's fix ships the update, but the revocation that actually blocks the old vulnerable boot manager ("Windows Production PCA 2011" into the DBX) is not enforced automatically. Patch reports say green, firmware still trusts the bad loader.
The attackers did need admin first, so this is persistence, not a way in. But once there, it loads before Windows and before any security tool on every boot.
If you run Windows fleets: don't trust "patched", check the DBX. Microsoft's KB5025885 covers it.
https://securelist.com/uefi-bootkit-blackx/121539/
zhashtoshi_ / Zhash
npub1v7…hvl8a
2026-10-24 10:37:55 UTC
Author Public Key
npub1v7nf76fh474q4dnqfjpnkyqsmg439n5uw9x9jdpvzmmgczvrwhcsuhvl8aSeen on
wss://relay.primal.netPublished at
2026-10-24 10:37:55 UTCEvent JSON
{
"id": "397f6d0cdb871e0d03c84ac43953623e10c1bb869e1eac3574def1f0ebba08a1",
"pubkey": "67a69f6937afaa0ab6604c833b1010da2b12ce9c714c59342c16f68c098375f1",
"created_at": 1792838275,
"kind": 1,
"tags": [],
"content": "A 2022 Secure Boot bug is still getting people owned in 2026. Kaspersky found BlackX, a UEFI bootkit used against diplomats in Central Asia (linked to APT41 with medium confidence). It abuses Baton Drop, CVE-2022-21894, the same trick as BlackLotus.\n\nThe uncomfortable part: the victims were patched. Microsoft's fix ships the update, but the revocation that actually blocks the old vulnerable boot manager (\"Windows Production PCA 2011\" into the DBX) is not enforced automatically. Patch reports say green, firmware still trusts the bad loader.\n\nThe attackers did need admin first, so this is persistence, not a way in. But once there, it loads before Windows and before any security tool on every boot.\n\nIf you run Windows fleets: don't trust \"patched\", check the DBX. Microsoft's KB5025885 covers it.\n\nhttps://securelist.com/uefi-bootkit-blackx/121539/",
"sig": "5f193f2792e71efdfb1518a8385777247af3b724e35f4b696e2c1c083246e7ae2e2ae14d0e79a891cf71e807393869d9b6e158fe473aa0e01d969719ceaeae7d"
}