Why a patched PC still loaded the BlackX bootkit, and how to check yours
Comments on “Why a patched PC still loaded the BlackX bootkit, and how to check yours”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Kaspersky reported BlackX, a UEFI bootkit it ties to APT41 with medium confidence, on fully patched Windows PCs at Central Asian diplomatic agencies. It reuses the Baton Drop Secure Boot bypass (CVE-2022-21894) seen in BlackLotus and was installed after attackers already had admin rights. Microsoft's fix, which blocklists the PCA 2011 certificate, is off by default. The claim that an "Updated" 2023 certificate status can coexist with PCA 2011 trust is the article's own inference.
Why it ranked
No. 4 of 124 with a score of 0.77. The panel rated it highest on technical depth (0.91) and new information (0.89), lowest on audience breadth (0.66).
Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.2
- Significance0.72
- Reader interest0.85
- Audience breadth0.66
- Practical relevance0.84
- Substantiated0.83
- Technical depth0.91
- New information0.89
- Counts against: Promotional0.03
- Counts against: Overclaim0.21
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.67 | 0.70 | 0.78 | 0.72 | 0.11 | +0.24 | +0.172 |
| Reader interest | 0.75 | 0.88 | 0.92 | 0.85 | 0.17 | +0.26 | +0.221 |
| Audience breadth | 0.67 | 0.72 | 0.58 | 0.66 | 0.14 | +0.13 | +0.086 |
| Practical relevance | 0.70 | 0.90 | 0.91 | 0.84 | 0.21 | +0.22 | +0.184 |
| Substantiated | 0.75 | 0.85 | 0.88 | 0.83 | 0.13 | +0.05 | +0.041 |
| Technical depth | 1.00 | 0.92 | 0.82 | 0.91 | 0.18 | +0.05 | +0.046 |
| New information | 0.91 | 0.80 | 0.96 | 0.89 | 0.16 | +0.05 | +0.045 |
| Promotional | 0.04 | 0.05 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| Overclaim | 0.24 | 0.20 | 0.18 | 0.21 | 0.06 | −0.11 | −0.023 |
| Sum of contributions | +0.765 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.765 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/4/"><img src="https://rubric.hrih.si/badge/2026-10-27/4.svg" alt="Ranked #4 on Rubric, 27 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 7 matches source · 1 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceGeneralization
Kaspersky reported the BlackX UEFI bootkit, which it ties to APT41 with medium confidence, on fully patched Windows machines at diplomatic agencies in Central Asia.
The cited source says the same thing.
The article says “Kaspersky found a UEFI bootkit it calls BlackX on machines at diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It ties the attack to APT41 with medium confidence”
The source says “Based on the following facts, we have attributed this attack to the APT41 threat actor with medium confidence”
Source cited by the article: securelist.com/uefi-bootkit-blackx/121539
Matches sourceQuote
Kaspersky says the BlackX exploit of Baton Drop (CVE-2022-21894) is remarkably similar to the one in BlackLotus, with the same goal of installing the attackers' own Machine Owner Keys.
The cited source says the same thing.
The article says “Kaspersky says the exploit is "remarkably similar" to the one in BlackLotus”
The source says “We noted that the implementation of the exploit is remarkably similar to the one used in the BlackLotus malware”
Source cited by the article: securelist.com/uefi-bootkit-blackx/121539
Matches sourceVersion
Microsoft's mitigations for CVE-2023-24932 ship in the July 9, 2024 updates and later, but are not enabled by default.
The cited source says the same thing.
The article says “The mitigations ship in the July 9, 2024 updates and later, but "these mitigations are not enabled by default”
The source says “Mitigations against the Secure Boot bypass detailed in CVE-2023-24932 are included in the Windows security updates that were released on July 9, 2024, and later updates. However, these mitigations are…”
Source cited by the article: support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
Matches sourceDate
KB5025885 says the Enforcement Phase will not begin before January 2026 and that Microsoft will give at least six months of advance warning.
The cited source says the same thing.
The article says “will not begin before January 2026" and that Microsoft will give "at least six months of advance warning”
The source says “The Enforcement Phase will not begin before January 2026, and we will give at least six months of advance warning in this article before this phase begins”
Source cited by the article: support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
Matches sourceQuote
Microsoft's registry guide describes the AvailableUpdates value 0x5944 as deploying all needed certificates and updating to the PCA2023 signed boot manager.
The cited source says the same thing.
The article says “Deploy all needed certificates and update to the PCA2023 signed boot manager”
The source says “0x5944 – Deploy all needed certificates and update to the PCA2023 signed boot manager”
Source cited by the article: support.microsoft.com/en-us/servicing/os/secure-boot/2025/09/registry-key-updates-for-secure-boot-windows-devices-with-it-managed-updates
No source givenCausal conclusion
Because 0x5944 does not contain the 0x80 or 0x200 bits, a PC can trust the new 2023 boot manager and still trust boot managers signed with PCA 2011.
The article gives no link or citation for it.
The article says “0x5944 does not contain the 0x80 bit or the 0x200 bit. So a PC can trust the new 2023 boot manager and still trust every old boot manager signed with…”
The source says No source to compare with.
Matches sourceQuote
KB5025885 warns that once the revocation is applied it cannot be reverted if Secure Boot continues to be used, and even reformatting the disk will not remove it.
The cited source says the same thing.
The article says “it cannot be reverted if you continue to use Secure Boot on that device. Even reformatting of the disk will not remove the revocations”
The source says “it cannot be reverted if you continue to use Secure Boot on that device. Even reformatting of the disk will not remove the revocations if they have already been applied”
Source cited by the article: support.microsoft.com/en-us/topic/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
Matches sourceQuote
Kaspersky says the October 19, 2026 expiry of PCA 2011 does not prevent vulnerable binaries from loading unless the certificate is blocklisted.
The cited source says the same thing.
The article says “does not prevent the vulnerable binaries from loading unless the certificate is blocklisted”
The source says “On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted”
Source cited by the article: securelist.com/uefi-bootkit-blackx/121539
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 21 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.