Fully Patched Windows Machines Were Still Open to Attack, Kaspersky Says
Kaspersky reported on Oct. 22, 2026, that a bootkit it calls BlackX got past Secure Boot on Windows machines that were fully patched. A bootkit loads before the operating system; Secure Boot is the check meant to stop it. Kaspersky says the reason the check failed is the fix itself, which does not take effect until an administrator switches it on by hand.
The report says the patch for Baton Drop, CVE-2022-21894, works by revoking the Windows Production PCA 2011 certificate that signs the vulnerable boot components. Installing the update does not perform that revocation. An administrator has to trigger it: setting a Secure Boot registry flag creates a scheduled task named Secure-Boot-Update. Kaspersky says the step was left manual on purpose, because an automatic revocation could stop dual-boot systems from loading. It assesses that the instructions, buried deep on Microsoft's website, are hard for an average IT administrator to notice.
Kaspersky says it found the bootkit in early 2026, in a campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky first assumed the victims had missed updates; the investigation showed otherwise. The attackers installed the bootkit only after compromising the networks and obtaining administrator privileges.
Kaspersky says two things that might have closed the gap have not. Microsoft's plan for the Baton Drop patches describes an enforcement phase that revokes the certificate automatically, and the report says that stage had not been implemented. Kaspersky says the certificate expired on Oct. 19, 2026, and that this does not stop the vulnerable files from loading unless the certificate is blocklisted.
Kaspersky says BlackX resembles BlackLotus, a bootkit sold on a hacking forum and confirmed as real by ESET in March 2023. The report says BlackLotus's source code was never published, so whoever built BlackX reverse-engineered it or bought the code. Kaspersky attributes the campaign to the APT41 threat actor with what it calls medium confidence.
Kaspersky says this is not the only such case: a 2025 Microsoft update for the ToolShell flaw also had to be applied by hand.
