CVE-2022-21894Baton Drop Secure Boot bypass reused by BlackX
A known bypass reused for persistence on hosts without required revocations; not a new remote initial-access flaw.
BlackX bootkit persisted on patched Windows hosts that lacked Secure Boot revocations
Kaspersky reports BlackX infections at Central Asian diplomatic organizations. Attackers already held administrator access and used a known Secure Boot bypass; Windows updates alone had not applied the required revocations. Attribution to APT41 is medium confidence.
- Disclosed
- Oct 22, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- 1 CVE tracked here
- Splash zone
- Windows hosts with missing Secure Boot revocations; deployment requires prior administrator access
- Windows · UEFI · BlackX · exploited
- In the wild
- Yes
- Kaspersky observed BlackX and follow-on payloads in targeted intrusions
What happened
This newly detailed campaign is rated L4 for confirmed exploitation and boot-level persistence. It is not a newly discovered Windows zero-day. Kaspersky observed diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan; initial network entry remains unspecified. Its link to APT41 is an assessment, not confirmed attribution.
Administrator access precedes installation. Investigators found patched machines missing the revocation step; certificate expiry is not equivalent to a DBX block. Apply Microsoft’s staged procedure, including recovery preparation, rather than copying isolated registry commands.
What’s in the bowl
Crime-scene timeline
Oct 22, 2026
Kaspersky publishes the BlackX investigation
New campaign details explain persistence despite Windows patch installation.
Early 2026 (approximate)
Researchers identify infections in Central Asian diplomatic agencies
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Kaspersky Securelist BlackX investigationPrimaryObserved campaign, artifacts, missing revocations and medium-confidence APT41 attribution
- Microsoft KB5025885PrimarySupported deployment procedure, firmware testing, recovery-media preparation and BitLocker recovery considerations