TL;DR

what: Kaspersky found BlackX, a BlackLotus-derived UEFI bootkit used against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and suspected to be APT41's work, exploiting CVE-2022-21894 to bypass Secure Boot.

impact: After the attacker gains admin rights, BlackX enrolls its own Machine Owner Keys, loads a signed kernel driver that tampers with endpoint security, and installs a RAT that uses Google Drive, OneDrive and Yandex.Disk for C2.

fix: Microsoft's full CVE-2022-21894 mitigation needs more than the update: the Windows Production PCA 2011 certificate also has to be on the Secure Boot Forbidden List (DBX), and that certificate's October 19, 2026 expiry does not stand in for the revocation.

who: Any Windows fleet that has the patch for CVE-2022-21894 but never applied Microsoft's Secure Boot revocation mitigations, with government and diplomatic organizations as the confirmed targets.

A suspected Chinese state group is defeating Secure Boot on Windows machines that pass patch…