Hackers Tied to China Beat Secure Boot on Fully Patched PCs Because Microsoft's Fix Needed a Manual Step

Every machine was fully patched, and the attackers still got beneath Windows. A state-linked espionage crew used a bootkit called BlackX to bypass Secure Boot on computers at diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, exploiting a flaw Microsoft fixed years ago.

The catch is that Microsoft's fix does not fully apply itself. Unless an administrator takes extra manual steps, the vulnerable certificate stays trusted. Almost nobody takes them.

A BlackLotus successor

Kaspersky's Global Research and Analysis Team found BlackX in early 2026 and presented it at Security Analyst Summit 2026 in Bali. The researchers attribute it with medium confidence to APT41, a Chinese state-sponsored group also tracked as Brass Typhoon, Wicked Panda and Barium.

BlackX is a modernized successor to BlackLotus, a bootkit sold on hacker forums since October 2022. It exploits Baton Drop (CVE-2022-21894) to enroll custom Machine Owner Keys and load arbitrary EFI files. Kaspersky called the exploit code "remarkably similar" to BlackLotus.

BlackLotus source code leaked incompletely in July 2023. Some BlackLotus samples contain code that was missing from the leak but shows up in BlackX, so the researchers believe the attacker either reverse-engineered BlackLotus or bought its source.

Blinding the defenders

The attackers deployed BlackX only after they had already broken into the networks and gained administrator rights. They dropped an installer, inst.exe, with no malicious strings, plus an RC4-encrypted file with no extension that held everything else. That made life hard for incident responders.

The bootkit injects a kernel driver signed with a now-revoked certificate issued to Wenjiang District Mingyu Network Technology Service Studio. The driver switches off security-related callbacks, tampers with Event Tracing for Windows so security tools go blind, and carries routines that run only when Kaspersky or Avast is installed. When something tries to open the bootkit's files, the driver hands back a handle to Windows Calculator instead.

Those routines failed against Kaspersky's products, the company says, and its endpoint protection blocked the attempt. This attack did not succeed. The follow-on toolkit was ready anyway: a remote access trojan using Google Drive, OneDrive or Yandex Disk for command and control, and OxiDLLRunner, an obfuscated DLL sideloaded by googleupdate.exe that launches a Rust payload to pull plugins. State crews keep finding ways to turn trusted components against their targets, much as Lazarus abused South Korea's mandatory security software.

Patched is not protected

Kaspersky first assumed the victims had been careless. Then it looked at the patch. Microsoft's Baton Drop fix is meant to revoke the "Windows Production PCA 2011" certificate used to sign vulnerable boot components, but the revocation does not happen on install. An administrator has to trigger it by hand by setting a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and running a Secure-Boot-Update scheduled task.

Microsoft made it manual because applying it automatically could break dual-boot systems that rely on that certificate. Kaspersky says it is extremely uncommon for admins to do anything by hand after an update.

The PCA 2011 certificate expired on October 19, 2026. That does not close the hole: the vulnerable binaries still load unless admins add the certificate to the DBX blocklist.

Kaspersky's advice is to run Microsoft's manual revocation steps, restrict admin privileges and monitor firmware integrity. The same gap sits on any Windows fleet where nobody ran the revocation.

Some offers on this page may be paid placements or contain affiliate links.