BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Banjoman301 · Saturday at 6:15 PM

From BleepingComputer -

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.

www.bleepingcomputer.com

garlin · Saturday at 6:48 PM

If I read the article correctly, the root security flaw is the same as in Black Lotus ("Baton Drop"). What they're seeing is some users or admins will install the CA 2023 certs, but failed to revoke PCA 2011. Therefore if you haven't revoked PCA 2011, you are still vulnerable to both BlackLotus and its new copycat BlackX.

Key points:
1. Secure Boot mode should be enabled.
2. Installing the new CA 2023 certs only allows you to continue booting new versions of Windows boot manager, past October 2026.
3. But without the separate action of revoking CA 2011, it doesn't close the door on attacks based on security holes from the older boot manager.

Users who don't follow the Secure Boot update process to the letter are still vulnerable as they were before. It's not a new security hole they're exploiting, but the same exploit using a different set of malware from another nation-state actor.

Just a reminder if you have installed the CA 2023 certs, to perform the PCA 2011 revocation ASAP.

Ghot · Saturday at 7:12 PM

Before running these commands, read post #4 just below

To add the “Windows Production PCA 2011” certificate to the Secure Boot UEFI Forbidden List (DBX).
Open a Command Prompt window as an Administrator, type these two commands separately, and then press Enter:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x80 /f

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

garlin · Saturday at 7:29 PM

As a pre-requisite for banning PCA 2011, you must have the Windows UEFI CA 2023 cert installed. Which works backwards to already having KEK CA 2023.

If you don't have Windows UEFI CA 2023 (the other CA 2023 certs apply to Linux and option ROM's), then the Secure Boot Task will refuse to ban PCA 2011 (because you don't want to block your UEFI from booting). But that set of commands is correct for revocation.

Ghot · Saturday at 7:32 PM

garlin said:
But that set of commands is correct for revocation.

Thank you kind sir.

Banjoman301 · Saturday at 9:08 PM

I'd suggest running garlin's Check-UEFI.bat to make sure Windows UEFI CA 2023 is installed, and PCA 2011 has been revoked.

STATUS REPORT
-------------
Scheduled Task: "Secure-Boot-Update" is Ready.

Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

IIRC, if PCA 2011 has not been revoked, instructions on how to do so are also included in the STATUS REPORT.

Steve C · 2026-10-25T03:21:08-0400

I have the 2023 certificates but the 2011 certificates have not yet been revoked. I was hoping for Windows Update to do that to avoid breaking anything. What's the safest method to revoke the old certificates?

Banjoman301 · 2026-10-25T03:57:00-0400

Post #3.

Then do the verification mentioned in post #6

Ghot · 2026-10-25T05:01:13-0400

Banjoman301 said:
Post #3.

Then do the verification mentioned in post #6

You mean like this... ??

How to check if your Secure Boot certs are updated. (three methods)

Method One Download cjee21's files, attached to the bottom of this post. 1. Save the file to your desktop. 2. Extract the contents to your desktop. 3. Open: Check-UEFISecureBootVariables-main 4. Right click: Check UEFI PK, KEK, DB and DBX.cmd ...and choose: Run as administrator. Your...

www.elevenforum.com

bikemanAMD · 2026-10-25T20:06:05-0400

I think mine is all set hopefully

Updated Windows USB Install Disk a bit ago, and then ran this, next probably tomorrow to get same results from Macrium Reflect X Rescue Media lol hopefully

Code:

PS D:\Scripts\Tools> .\Check_BootMedia.ps1 -Audit -verbose

Security warning
Run only scripts that you trust. While scripts from the internet can be useful, this script can potentially harm your
computer. If you trust this script, use the Unblock-File cmdlet to allow the script to run without this warning
message. Do you want to run D:\Scripts\Tools\Check_BootMedia.ps1?
[D] Do not run  [R] Run once  [S] Suspend  [?] Help (default is "D"): R
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON

UEFI KEK Certs
--------------
    Microsoft Corporation KEK CA 2011
    Microsoft Corporation KEK 2K CA 2023

UEFI DB Certs
-------------
    Microsoft Corporation UEFI CA 2011
    Microsoft Windows Production PCA 2011
    Microsoft Option ROM UEFI CA 2023
    Microsoft UEFI CA 2023
    Windows UEFI CA 2023

UEFI DBX Certs
--------------
    Microsoft Windows Production PCA 2011
    Windows BootMgr SVN 12.0

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.
        \\.\HarddiskVolume1\EFI\Microsoft\Boot\SkuSiPolicy.p7b
        Version: 3.0.0.19

        FileRule             MinimumFileVersion MaximumFileVersion
        --------             ------------------ ------------------
        ID_FILEATTRIB_F_0044 0.0.0.0            10.0.14393.9579
        ID_FILEATTRIB_F_0042 10.0.14400.0       10.0.17763.9339
        ID_FILEATTRIB_F_0040 10.0.18000.0       10.0.19041.7759
        ID_FILEATTRIB_F_0041 10.0.19100.0       10.0.20348.5719
        ID_FILEATTRIB_F_0046 10.0.20400.0       10.0.22621.7619
        ID_FILEATTRIB_F_0049 10.0.23000.0       10.0.26100.9680
        ID_FILEATTRIB_F_0045 10.0.26100.32000   10.0.26100.33589
        ID_FILEATTRIB_F_0048 10.0.26172.0       10.0.26172.33590
        ID_FILEATTRIB_F_0047 10.0.27000.0       10.0.28000.3200
        ID_FILEATTRIB_F_0043 10.0.29426.0       65535.65535.65535.65535



Macrium v10.0.8843
------------------
    WinRE Boot Manager [Production PCA 2011] is BANNED.
        c:\boot\macrium\WinREFiles\media\EFI\Microsoft\Boot\bootmgfw.efi
        File Version: 28000.367, SVN 11.0

    WinPE Boot File [Windows UEFI CA 2023] is BANNED.
        c:\boot\macrium\WA11KFiles\media\EFI\Boot\bootx64.efi
        File Version: 26100.30227, SVN 7.0

Bootable Media
--------------

USB Drive F: "Win64 Pro"
    Boot File [Windows UEFI CA 2023] is ALLOWED.
        F:\EFI\Boot\bootx64.efi
        File Version: 28000.376, SVN 12.0

    boot.wim:2 (WinPE 26100.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.376, SVN 12.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9711

        'Repair My PC' is broken in WinPE.

    F:\EFI\Microsoft\Boot\boot.stl [9/2/2026 2:37 PM] is CURRENT.

    install.esd:1 (W11 26H2 26300.9711)
        Boot Manager [Windows UEFI CA 2023] is ALLOWED.
            \Windows\Boot\EFI_EX\bootmgfw_EX.efi
            File Version: 28000.376, SVN 12.0

        \Windows\System32\winload.efi is ALLOWED.
            File Version: 26100.9711

        Skipping over the next 6 images.

garlin · 2026-10-25T21:08:09-0400

bikemanAMD said:
I think mine is all set hopefully

Code:

UEFI DBX Certs -------------- Microsoft Windows Production PCA 2011 Windows BootMgr SVN 12.0

PCA 2011 is correctly revoked on this PC.

Steve C · 2026-10-26T03:01:11-0400

When can we expect Windows Update to revoke the 2011 certificates for PCs updated with the 2023 certificates? I'm wary of revoking the 2011 certificates manually and breaking something.

dacrone · 2026-10-26T03:42:03-0400

Steve C said:
When can we expect Windows Update to revoke the 2011 certificates for PCs updated with the 2023 certificates? I'm wary of revoking the 2011 certificates manually and breaking something.

2032

Steve C · 2026-10-26T03:45:04-0400

dacrone said:
2032

What;s your source?

thecaretaker · 2026-10-26T04:57:26-0400

Do I need to do anything to my PC to make it safe?

Code:

Checking for Administrator permission...
Running as administrator - continuing execution...

26 October 2026
Manufacturer: Gigabyte Technology Co., Ltd.
Model: Z690 GAMING X
BIOS: American Megatrends International, LLC., F34, F34, ALASKA - 1072009
Windows version: 26H2 (Build 26300.9711)

Secure Boot status: Enabled

Current UEFI PK
√ GIGABYTE

Default UEFI PK
√ GIGABYTE

Current UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: False)
√ Microsoft Corporation KEK 2K CA 2023 (revoked: False)
√ GIGABYTE (revoked: False)

Default UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: False)
√ Microsoft Corporation KEK 2K CA 2023 (revoked: False)
√ GIGABYTE (revoked: False)

Current UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: True)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
√ Windows UEFI CA 2023 (revoked: False)
√ Microsoft UEFI CA 2023 (revoked: False)
√ Microsoft Option ROM UEFI CA 2023 (revoked: False)
√ GIGABYTE (revoked: False)
√ GIGABYTE (revoked: False)

Default UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: True)
√ Microsoft Corporation UEFI CA 2011 (revoked: False)
√ Windows UEFI CA 2023 (revoked: False)
√ Microsoft UEFI CA 2023 (revoked: False)
√ Microsoft Option ROM UEFI CA 2023 (revoked: False)
√ GIGABYTE (revoked: False)
√ GIGABYTE (revoked: False)

Current UEFI DBX
2025-10-14 (v1.6.0) : SUCCESS: 431 successes detected
Windows Bootmgr SVN : 7.0
Windows cdboot SVN : 3.0
Windows wdsmgfw SVN : 3.0

jimbo45 · 2026-10-26T05:47:51-0400

@thecaretaker

No -- worry about scams instead - far more of a problem.- These other types of hacks etc are nowadays directed at corporate entities and attempts to disable national and international infrastructures e.g travel, banking, energy supplies, border controls etc.

Cheers
jimbo

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer