The Patch Went In. The Bootkit Booted Anyway.

A UEFI bootkit called BlackX ran on Windows machines that had every update installed. Kaspersky’s researchers went looking for unpatched systems and found something worse. The patch had gone in, and it had never finished its job.

The bootkit is not new. BlackX exploits Baton Drop, tracked as CVE-2022-21894, the same flaw the BlackLotus bootkit used in 2023. It enrolls a custom Machine Owner Key and loads whatever EFI file it likes, so Secure Boot ends up validating the attacker’s loader instead of rejecting it. Kaspersky attributes the campaign to APT41 with medium confidence and ties it to intrusions against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026.

The patch waited for a person who never came

Microsoft’s fix does not revoke the vulnerable boot managers by itself. It stages a revocation of the Windows Production PCA 2011 certificate and waits. An administrator has to set a flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and trigger a scheduled task named Secure-Boot-Update. The instructions sit in a Microsoft blog post that most admins will never open, because their patch dashboard already turned green.

That manual step is the whole vulnerability now. The Secure Boot revocation is deliberate and staged, because forcing it automatically can break dual boot machines that still depend on the certificate. Microsoft’s plan calls for a later enforcement phase that does it without an administrator. As of Kaspersky’s publication that phase has not shipped. The certificate expired on October 19, 2026, and the expiration alone does not stop vulnerable binaries loading. Only a blocklist entry does.

What it leaves behind is not subtle

The driver is signed with a revoked certificate issued to an outfit calling itself Wenjiang District Mingyu Network Technology Service Studio. It kills security processes, strips registry callbacks, tampers with Event Tracing for Windows, and intercepts attempts to open its own files by launching the Windows calculator instead. The follow-on payloads are a remote access tool that hides command traffic inside Google Drive, OneDrive and Yandex Disk, and a Rust loader delivered through DLL sideloading of googleupdate.exe.

That cloud storage choice is the detail to sit with. Most networks allow those domains, and almost none of them inspect what moves through them.

Check the flag, not the dashboard

Confirm the registry flag, trigger the task, and verify the certificate is blocklisted rather than expired and forgotten. Treat a patch compliance number as evidence about files, not about the boot path. BleepingComputer’s writeup carries the indicators.

This is the same shape as the PHP2Shell patch window last week. The upgrade landed, the exposure stayed, because the fix needed a second action nobody scheduled.

Source, the Kaspersky Securelist report, October 22 2026.