Kaspersky: patched PCs fell to a bootkit as Microsoft's fix needs a manual step

A patch can be installed and still not protect you. A Kaspersky report shows how wide that gap can be. Attackers hit diplomatic agencies in Central Asia through a flaw that had a fix. The targeted machines had that fix installed.

What Kaspersky found

Kaspersky says it found a complex spying attack in early 2026. The targets were diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The attackers used a bootkit that Kaspersky named BlackX. A bootkit is malware that loads before Windows starts. That lets it run ahead of most security tools.

The attackers installed BlackX only after they broke into the networks. They had already gained administrator rights. Kaspersky first assumed the victims had skipped updates. Its investigation showed the machines were fully patched.

How the attack works

BlackX exploits a flaw called Baton Drop (CVE-2022-21894). The flaw lets an attacker get past Secure Boot. Secure Boot is the check that lets a PC start only trusted, signed software. The exploit installs custom Machine Owner Keys. These keys let the machine load boot files that the attacker picks.

Next, the bootkit places a malicious driver in the Windows kernel. The kernel is the core of the operating system. Kaspersky says the driver switches off callbacks that security products rely on. It also tampers with Windows event tracing, so those products cannot reach the telemetry it produces. To protect its own files, it answers file requests with a handle to calc.exe.

Some of this tampering is aimed at Kaspersky or Avast products. In Kaspersky's testing, it failed to interfere with Kaspersky products.

The driver then delivers spying tools. One is a remote-access trojan. It talks to its operators through Google Drive, OneDrive or Yandex.Disk. The other, which Kaspersky calls OxiDLLRunner, carries a Rust payload. That payload is built to contact a command server and run plugins it receives.

The installer, inst.exe, holds no malicious strings. Everything sits in one encrypted file. That makes the parts harder for responders to recover.

Why a patched machine was still open

Kaspersky says the Baton Drop fix revokes trust in the "Windows Production PCA 2011" certificate. That certificate signed the vulnerable boot components. Installing the update does not revoke it. An administrator must trigger the step by hand.

Kaspersky says the manual design has a reason. An automatic switch could break dual-boot systems that rely on that certificate. The result is a patch that looks finished while the gap stays open.

Administrators usually move on once an update installs, unless it reports an error. Kaspersky says the instructions for activating this fix are hard to find on Microsoft's website. In its judgment, a typical IT administrator is unlikely to come across them.

Microsoft's rollout plan mentions an "Enforcement Phase". That phase would revoke the certificate automatically. Kaspersky says it was not in place when the report was published.

The certificate expired on October 19, 2026. That does not close the gap. Per Kaspersky, the vulnerable files can still load until the certificate is placed on a blocklist.

A criminal tool, borrowed

BlackX resembles BlackLotus. A seller advertised BlackLotus on a hacking forum in October 2022 for $5,000. ESET confirmed in March 2023 that the ad was genuine.

Kaspersky says the BlackLotus source code has never been published online. Kaspersky says this could mean the BlackX authors either reverse-engineered it or bought the code. It adds that it rarely sees APT groups borrow from criminals.

Kaspersky attributes the campaign to APT41 with medium confidence. One reason is an "xdd" label found in BlackX. The same label appears in a kernel implant that ESET described in June 2026. ESET tied that implant to FishMonger. The community assumes FishMonger is related to APT41.

Two technical habits also point that way. The payloads use DLL sideloading, which abuses a legitimate program to load a malicious file. They also use OLLVM obfuscation, which scrambles code to hide it. Kaspersky says both are common among Chinese-speaking actors.

Kaspersky believes the group counted on few organizations activating the patch. That made a BlackLotus copycat worth building.

What leaders should ask

This shows that "patched" on a dashboard records an installation. It is not proof of protection. Kaspersky points to a second example from 2025: Microsoft's fix for the ToolShell vulnerability also needed manual action to take effect. Two examples are not a trend.

Put these questions to your security and IT teams. Which of our patches need an extra step after install, and who owns that step? Can we show, machine by machine, that the Baton Drop revocation was applied? Have we weighed dual-boot systems against the risk? If a patch fails silently, which tool would still catch the exploit?

Kaspersky's answer to the last question is endpoint software with exploit prevention on every machine, watched constantly. That is a vendor recommending its own category, so test any such tool yourself. The sound principle is defence that does not depend on one patch being fully switched on.

A patch that is installed but not activated is a promise, not a protection.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Kaspersky.