‘Fully patched’ sounds like the finish line for security. A newly reported bootkit shows it isn’t always.
Kaspersky has discovered BlackX, a UEFI bootkit used against diplomatic organisations in Central Asia, specifically in Tajikistan, Uzbekistan and Turkmenistan. A bootkit is malware that loads during startup, before Windows and before your security software, which makes it extremely hard to spot and remove.
Kaspersky attributes the campaign with moderate confidence to APT41, a well-known Chinese state-backed hacking group, as BleepingComputer reports.
The technical trick is an old one. BlackX exploits Baton Drop, tracked as CVE-2022-21894, a Secure Boot flaw dating back to 2022. Using it, the attackers enrolled their own Machine Owner Keys and loaded arbitrary EFI code, getting around Secure Boot, the feature that is supposed to make sure only trusted code runs at startup.
Here’s the part every IT team should note. The victims’ machines were fully patched. That didn’t help, because Microsoft’s Baton Drop mitigation isn’t fully applied automatically. It requires administrators to revoke the ‘Windows Production PCA 2011’ certificate in the Secure Boot DBX, the list of blocked boot components. Until that’s done, the vulnerable boot files can still be abused.
Microsoft has published guidance on managing these Windows Boot Manager revocations as part of the Secure Boot changes tied to CVE-2023-24932. Because applying revocations changes what the PC is allowed to boot, Microsoft’s guidance walks administrators through the steps carefully rather than switching everything on automatically.
Security news site SOCtember described the campaign as APT41 reviving the BlackLotus bootkit approach, and summed up the problem bluntly: the Baton Drop fix does nothing until administrators switch it on.
For attackers, that gap between ‘patch installed’ and ‘protection switched on’ is an opportunity, and BlackX shows a capable group taking advantage of it.
Why it matters
Malware that runs before the operating system can survive reinstalls and hide from antivirus. The practical lesson: don’t stop at installing updates. Check whether optional security mitigations, like Secure Boot revocations, are actually enabled across your machines. Any organisation handling sensitive data should add boot-level security to its next audit.
Sources: Kaspersky, Securelist, BleepingComputer, SOCtember, Microsoft Support. Written by the xRapid Media LLP team.