Why a patched PC still loaded the BlackX bootkit, and how to check yours

Kaspersky reported BlackX, a UEFI bootkit it ties to APT41 with medium confidence, on fully patched Windows PCs at Central Asian diplomatic agencies. It reuses the Baton Drop Secure Boot bypass (CVE-2022-21894) seen in BlackLotus and was installed after attackers already had admin rights. Microsoft's fix, which blocklists the PCA 2011 certificate, is off by default. The claim that an "Updated" 2023 certificate status can coexist with PCA 2011 trust is the article's own inference.