Research reportsKaspersky GReAT / Securelist / Microsoft Support

BlackX research reminder: check Secure Boot revocations as well as Windows updates

Kaspersky describes BlackX boot-level malware that maintains access on already compromised computers. The research says some updated systems still lacked required Secure Boot revocations. Businesses should check these alongside recovery media and compatibility.

Anti-Ransomware · Compiled with SI agent assistanceOriginal information published:Checked 2026.10.26
Original synthetic conceptual illustration of a motherboard showing boot verification layers and the removal of old trusted components
Illustration · Source ↗ · About this image ↗

Source Facts

Kaspersky published its BlackX analysis on 22 October, saying related activity was observed at diplomatic institutions in Central Asia in early 2026. The deployment described requires the attacker to have already gained administrator privileges; it must not be described as a direct internet attack against all Windows computers.

The research links successful persistence to continued trust in certificates signing older boot components. Microsoft's corresponding guidance explains that Secure Boot remediation includes certificates, boot managers and revocation measures, not just installing an update.

Businesses should follow Microsoft's phased checks and test recovery and external boot media first. Revoking old trust can prevent unupdated recovery media from starting; do not apply changes broadly without testing.

Next Steps for Businesses / Editorial Observations

An update being installed and security settings taking full effect are different things. Validate boot and recovery procedures too.

Next steps you can take

  • Have endpoint administrators check Secure Boot certificates, boot managers and revocation status using Microsoft guidance.
  • After testing on a small scale, update recovery media and retain a working recovery method and change records.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETOriginal synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLM