Kaspersky’s October 22 research describes BlackX, a bootkit observed in early-2026 attacks against diplomatic agencies in Central Asia. Researchers say attackers already had administrative access before deploying it. They attribute the campaign to APT41 with medium confidence.
The report says targeted machines had Windows patches installed, but lacked the additional certificate-revocation steps needed to block vulnerable boot components. BlackX exploited the older Baton Drop vulnerability to interfere with Secure Boot. The finding concerns incomplete activation of a protection, rather than evidence that every updated Windows computer is compromised.
NAOAT analysis
For organizations, this distinction changes what a maintenance record should prove. A completed software installation is one checkpoint; the intended security state is another. When vendor instructions describe follow-on configuration, the change ticket should name the responsible administrator and record how the resulting state was checked. An inventory that only records update numbers can leave that second task invisible.
Boot-related changes also belong in an operational plan. A business needs to know which devices require compatibility testing, which recovery materials are available and who can assist if a machine fails to start. Those questions should be answered through current vendor documentation and controlled testing, rather than by copying registry instructions from a news summary.
The audience for this report extends beyond security specialists to the people who accept maintenance work as complete. Procurement teams can request evidence of the delivered configuration; IT managers can make exceptions visible; service providers can define the handoff between patch installation and validation. This is a practical way to turn a research finding into a clearer service standard without assuming the reported diplomatic campaign describes the exposure of every workplace.