{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "windows-secure-boot-blackx-bootkit",
  "url": "https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit/",
  "path": "/incidents/windows-secure-boot-blackx-bootkit/",
  "json_url": "https://patchgap.ai/incidents/windows-secure-boot-blackx-bootkit.json",
  "title": "Windows: a hidden start-up virus (BlackX) works even on updated PCs, unless one extra step is done",
  "category": "windows",
  "platforms": [
   "windows"
  ],
  "products": [
   "windows"
  ],
  "status": "partial",
  "status_label": "Partly patched",
  "severity": "medium",
  "severity_source": "NVD score 4.4 for the old bug it uses (CVE-2022-21894). Real attacks so far hit government targets.",
  "exploited_in_wild": "yes",
  "exploited_note": "Kaspersky says it found BlackX used in a spying campaign against government offices in Central Asia in early 2026.",
  "exploited_source_url": "https://securelist.com/uefi-bootkit-blackx/121539/",
  "confidence": "unconfirmed",
  "confidence_note": "The attacks come from Kaspersky's research report. Microsoft has not published anything about BlackX itself. Microsoft's own guide confirms the extra step is off by default.",
  "first_reported": "2026-10-22",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2022-21894"
  ],
  "summary": "Secure Boot is a lock that checks your computer's start-up files. Researchers at Kaspersky found a virus called BlackX that gets past this lock. It uses an old bug that Microsoft fixed in 2023, but the fix is not fully switched on unless an extra step is done by hand. The attacks found so far hit government targets, so most home users are at low risk. Still, it is worth knowing about.",
  "am_i_affected": "Probably not a big risk for a home computer, but it could be if your PC uses Secure Boot and the extra Microsoft step was never done. A read-only check is below. Ask an IT helper before you change anything, because the wrong steps can stop old recovery drives from working.",
  "action": "Windows: install updates, then check the extra Secure Boot step",
  "affected": [
   {
    "product": "windows",
    "product_name": "Windows 10 and 11",
    "platform": "windows",
    "affected_versions": "Windows PCs with Secure Boot where Microsoft's extra 'revocation' step was never turned on",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Microsoft's protection is in updates from July 9, 2024 and later, but it is NOT turned on by default. You must turn it on by following Microsoft's guide.",
    "fixed_source_urls": [
     "https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023"
    ],
    "check": {
     "menu_path": "Start > Settings > Windows Update. Then click Update history to see recent updates.",
     "command": "Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a"
   }
  ],
  "fix_steps": [
   "First install all Windows updates (Settings > Windows Update).",
   "Make a backup of your important files.",
   "Read Microsoft's guide (link below) before changing anything. Microsoft warns that turning this on can make older start-up or recovery drives stop working.",
   "If you are not comfortable with these steps, ask an IT helper. Do not skip the backup.",
   "Run the read-only check to see if the change is already on."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: how to manage the Windows Boot Manager revocations (KB5025885)",
    "url": "https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023"
   }
  ],
  "extra_checks": [
   {
    "platform": "windows",
    "label": "Is the old Windows start-up certificate already blocked? (True = blocked, False = not yet). Needs 'Run as administrator'.",
    "command": "[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'",
    "shell": "PowerShell (Admin)",
    "read_only": true
   }
  ],
  "sources": [
   {
    "url": "https://securelist.com/uefi-bootkit-blackx/121539/",
    "title": "Kaspersky Securelist: BlackX bootkit",
    "date": "2026-10-22",
    "kind": "research",
    "official": false
   },
   {
    "url": "https://support.microsoft.com/en-us/servicing/os/windows/2023/03/how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023",
    "title": "Microsoft: Windows Boot Manager revocations for Secure Boot (KB5025885)",
    "date": "2023-05-09",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21894",
    "title": "NVD: CVE-2022-21894",
    "date": "2022-01-11",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}