BlackX bootkit: check your Secure Boot revocation

Kaspersky says APT41 used the Baton Drop flaw against machines that had the fix installed but never activated. Microsoft's KB 5025885 has the steps that close the gap, and the events that prove each one worked.

A new UEFI bootkit called BlackX got past Secure Boot on Windows machines that had every patch installed. Kaspersky's researchers published the findings on October 22: the attackers, whom Kaspersky links to APT41 with medium confidence, used the Baton Drop flaw (CVE-2022-21894) against diplomatic agencies in Turkmenistan, Tajikistan and Uzbekistan. Kaspersky says it found the campaign in early 2026.

The fix was on those machines. It was never switched on. According to Kaspersky, Microsoft's Baton Drop update only protects a device once the "Windows Production PCA 2011" certificate is revoked, and that revocation is a manual step. Kaspersky says installing the update does not apply the revocation, and that it is extremely unusual for administrators to take extra steps after an update. That makes it a fleet question for every Windows shop.

Why patched is not protected

Microsoft has planned an Enforcement Phase that would apply the revocation automatically on capable devices. Its support article KB 5025885 says that phase "will not begin before January 2026". Its date is still to be announced. As of the Kaspersky report, it had not started.

The certificate's expiry does not help either. Microsoft's certificate page (KB 5062710) lists October 19, 2026 as the expiry date for Windows Production PCA 2011, with Windows UEFI CA 2023 as its replacement. Kaspersky and BleepingComputer both note that an expired certificate still lets old, vulnerable boot managers load unless it is blocklisted. In Microsoft's process, that blocklist is the DBX.

BlackX also needs a foothold first. Kaspersky says the attackers already had administrator rights on the victims' networks. Its kernel driver then interferes with security tools' callbacks and ETW providers, and BleepingComputer says it goes after Kaspersky and Avast products.

The steps Microsoft gives

All of this is in KB 5025885. The values go in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot, as the REG_DWORD AvailableUpdates. After each change, run the update task from an elevated PowerShell prompt: Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update". Microsoft says a restart may be needed if Virtual Secure Mode is on.

Step	AvailableUpdates value	What it does	Event that confirms it
Before you start	none	Install the latest Windows security updates on every device	none
1	0x5944	Adds the 2023 certificates to the DB and updates the boot manager	1036
2	none	Check that the 2023-signed boot manager is in place	1799
3	0x80	Adds the PCA 2011 certificate to the DBX, the revocation BlackX relies on being absent	1037
4	0x200	Applies the SVN update to the firmware	1042

Microsoft attaches three warnings to step 3. The change cannot be reverted while the device keeps using Secure Boot, and reformatting the disk does not undo it. Older recovery and install media may no longer boot, so media has to be rebuilt first. And some devices may drop into BitLocker recovery, so keep each device's recovery key before you start.

The article covers Windows 10 22H2 and the LTSB and LTSC editions, Windows 11 22H2 through 25H2, and Windows Server 2012 and 2012 R2 (on ESU) through Windows Server 2025.

Kaspersky's report lists indicators, among them an installer at C:\ProgramData\Intel\inst.exe, the domain www[.]archivetj[.]com, and command traffic over Google Drive, OneDrive and Yandex.Disk.

What IT teams should do

Query Windows event logs across the fleet for events 1036, 1799 and 1037. A device without 1037 has not revoked PCA 2011 and is open to Baton Drop, whatever its patch level.
Before step 3 in the table, rebuild recovery and install media and escrow BitLocker recovery keys.
Roll out steps 1 and 3 in rings, starting with high-risk machines such as admin workstations and devices used by executives and staff who travel.
Treat any machine where an attacker may have had admin rights as a possible bootkit case, and check it against Kaspersky's indicators.
Do not wait for Microsoft's Enforcement Phase. It has no date yet.

BlackX hit patched PCs: how to check your Secure Boot revocation

Why patched is not protected

The steps Microsoft gives

What IT teams should do

Sources