The fix for this one has existed since 2023. Almost nobody switched it on.

A week ago we wrote about the Microsoft Windows Production PCA 2011 certificate expiring on 19 October, and mentioned BlackLotus, the bootkit that loads before Windows and therefore before anything can see it. Kaspersky has now published a copy of BlackLotus found in the wild, and the interesting part is not the malware.

It is called BlackX. Kaspersky's GReAT team described it on 22 October, with BleepingComputer following on the 24th. It was used in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, and it is attributed with medium confidence to APT41. It exploits CVE-2022-21894, the flaw nicknamed Baton Drop, to enrol its own Machine Owner Key and load whatever EFI file it likes past Secure Boot. Then it drops a kernel driver, signed with a certificate issued to something called Wenjiang District Mingyu Network Technology Service Studio, which quietly tampers with Kaspersky and Avast if it finds either installed. The driver also hides the bootkit's files, and if you try to open one it opens Windows Calculator instead.

Here is the bit that matters to everyone else. These machines were patched. Microsoft fixed Baton Drop in 2023, but installing the fix does not revoke the vulnerable boot components, because revoking them would break dual-boot setups. Someone has to set a registry flag and run a scheduled task to finish the job, and in practice almost nobody does. The protection shipped. It sat there switched off for three years.

No home PC is a target for an espionage crew working on Central Asian embassies, so there is nothing to panic about tonight. The habit worth taking from it is smaller: "fully updated" and "fully protected" are not the same sentence, and the Secure Boot state on your own machine is worth a glance now that the certificate changeover has passed. Tendvane's security-posture check reads that state, along with BitLocker, so you can see it without hunting through menus.