Kaspersky described BlackX, a bootkit that loads before Windows through UEFI and exploits the known Baton Drop flaw, CVE-2022-21894, to bypass Secure Boot. It was used in early 2026 against diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan. The researchers attribute it with medium confidence to the APT41 group. According to the analysis, even fully patched Windows systems remain exposed unless the revocation of Microsoft's old PCA 2011 certificate has been applied manually.

What it means: Bootkits are among the hardest threats to deal with, because they start before the operating system and security tools, and can survive even a Windows reinstall. The key point here is that the flaw was fixed back in 2022, but the fix alone is not enough: old, vulnerable boot loaders remain signed with the 2011 certificate and can still be used unless an administrator applies the revocation steps Microsoft has documented. This campaign's targets are diplomatic and geographically limited, but the technique is available to anyone who studies it. For Greek businesses and public bodies holding sensitive data the message is practical: check whether your PCs and servers have an up-to-date DBX revocation list and whether the move to Microsoft's 2023 Secure Boot certificates has been made, which Microsoft is already pushing because the old ones expire. Test the process on a few machines first, since mistakes can stop systems from booting. Organisations covered by NIS2 should record the action in their vulnerability-management plan, since it concerns the boot integrity of every system they run.

Read the original on Kaspersky Securelist

Related service: Custom software

Related stories