A spying tool that loads before Windows starts got past Secure Boot on fully patched computers at diplomatic agencies in Central Asia because a manual step in Microsoft's fix had never been taken, according to research by security company Kaspersky that BleepingComputer reported Saturday. The finding means organizations that treat "patched" as "protected" may still be open to implants that run beneath the operating system, where security software struggles to see them.
Secure Boot is a feature of a PC's firmware, the low-level software that starts the machine, that lets only trusted, digitally signed startup code run. A bootkit is malware that hides in that startup process, so it runs before Windows and its defenses and survives reinstalls.
What Happened
Kaspersky's report, "How APT41 Revived the BlackLotus Bootkit to Attack Diplomatic Organizations in Central Asia," published Oct. 22, describes a bootkit it calls BlackX, found in early 2026 in attacks on diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The attackers had already broken into the victims' networks and gained administrator rights before installing it.
BlackX exploits Baton Drop, a Windows flaw tracked as CVE-2022-21894, to bypass Secure Boot and enroll its own Machine Owner Keys, entries that tell the startup process which additional software to trust. That lets it load any startup files it chooses.
All the victim machines were fully patched, Kaspersky said. Microsoft's fix depends on revoking a certificate called "Windows Production PCA 2011," which signed vulnerable startup components, and that revocation is not automatic. An administrator must set a registry flag and create a scheduled task. Kaspersky said Microsoft keeps the step manual because automatic revocation could break computers set up to start more than one operating system, and that a planned enforcement phase that would revoke the certificate automatically had not taken effect. The certificate expired Oct. 19, but Kaspersky noted that expiry alone does not stop vulnerable startup files from loading unless the certificate is blocked.
The exploit closely resembles BlackLotus, a bootkit first advertised on a hacking forum in 2022 for $5,000. Kaspersky suggested the BlackX author either reverse-engineered BlackLotus or bought its source code.
Once running, BlackX installs a kernel driver that disables hooks security products rely on and tampers with Windows event tracing, a logging system defenders read. Other components include a remote-access tool that uses Google Drive, OneDrive or Yandex.Disk to receive commands, and a loader written in the Rust programming language.
Kaspersky attributes the campaign to APT41 with medium confidence. It cites an identifier also found in ESET's June 2026 reporting on a group called FishMonger, which researchers link to APT41, and techniques Kaspersky says are common among Chinese-speaking threat actors. BleepingComputer noted APT41 is also tracked as Brass Typhoon, Wicked Panda and Barium. BleepingComputer's article contains no statement from Microsoft.
Why It Matters
The victims were in Central Asia, but the weakness is not regional. Any Windows fleet, including those of U.S. companies and agencies, that installed the updates without completing the revocation is in the same position. Patch-compliance reports, which boards often see as a proxy for security, would show these machines as up to date.
Kaspersky made a similar point about the 2025 ToolShell fix, which also required manual steps. When fixes depend on extra configuration that is easy to miss, the gap between installing a patch and being protected becomes a governance question.
The attack also required prior administrator access. A bootkit is a way to stay hidden on a network already breached, so detecting the initial intrusion remains the first line of defense.
What to Check
According to Kaspersky, the revocation is controlled by a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and a scheduled task named Secure-Boot-Update. BleepingComputer points administrators to Microsoft's guidance, "Revoking Vulnerable Windows Boot Managers." Because Kaspersky says automatic revocation can break dual-boot machines, teams should test before rolling it out widely.
What to Watch
- Whether Microsoft responds to the report or brings forward its automatic enforcement phase.
- Whether other researchers find BlackX on networks outside Central Asia.
- Whether organizations begin reporting revocation status alongside patch status.
