BlackX Bootkit Bypasses Secure Boot on Some Patched PCs

A newly identified bootkit called BlackX can bypass Secure Boot on some Windows computers even after the underlying security flaw has been patched. The attack is not aimed at US households in the reported campaign, but it shows why installing Windows updates may not fully protect a PC when required Secure Boot revocations are missing.

What happened

BlackX runs in a computer’s UEFI startup environment, allowing it to load malicious code before Windows and security software start. According to The Hacker News, Kaspersky found the malware in attacks against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan during early 2026.

The bootkit exploits CVE-2022-21894, a Secure Boot bypass vulnerability that Microsoft has already patched. However, the report says fully blocking the attack also requires Secure Boot revocation measures, including adding the Windows Production PCA 2011 certificate to the UEFI Forbidden List, commonly called the DBX.

That certificate expired on October 19, 2026, but expiration alone does not stop vulnerable startup files from loading. The certificate must be placed on the blocklist, according to Kaspersky’s findings.

BlackX is used after attackers have already entered a network and obtained administrator privileges. Microsoft previously explained that this type of bootkit is not an initial way into a computer; an attacker needs privileged access or physical access before installing it. Once present, BlackX can interfere with Windows startup protections and attempt to disrupt security software.

Who is affected

The disclosed attacks targeted diplomatic organizations in Central Asia, not households or small offices in the United States. No affected PC brands or models were identified in the source.

The potential exposure applies to Windows computers that can still load startup files signed with the vulnerable certificate because the necessary Secure Boot revocations have not been activated. A fully updated computer could therefore remain exposed to this particular bypass if its revocation list is incomplete.

The report does not say that BlackX is spreading broadly, and an attacker cannot install it remotely on an untouched PC without first gaining administrator-level or physical access.

What to do now

1. Run your normal Windows Update process and install every available security update. Restart the computer when prompted so startup-related changes can take effect.

2. Check whether your PC manufacturer offers UEFI or firmware updates for your exact model. Follow only the manufacturer’s instructions, since an interrupted or incorrect firmware update can prevent a computer from starting.

3. Ask Microsoft support, your PC maker or a qualified technician whether the Windows Production PCA 2011 Secure Boot revocation is active on the computer. The source does not provide a safe consumer-facing method for verifying or applying it.

4. Do not disable Secure Boot as a workaround. BlackX is specifically designed to undermine startup protections, so turning those protections off would not solve the underlying problem.

5. Protect administrator access. Use a standard account for everyday work when possible, and do not approve unexpected requests for administrator permission. BlackX installation requires privileged or physical access, according to the report.

6. If an unfamiliar person had physical access to the PC or someone obtained administrator control, disconnect it from sensitive accounts and seek professional help. Removing a bootkit may require more than an ordinary antivirus scan because it operates before Windows starts.