Secure Boot is a lock that checks your computer's start-up files. Researchers at Kaspersky found a virus called BlackX that gets past this lock. It uses an old bug that Microsoft fixed in 2023, but the fix is not fully switched on unless an extra step is done by hand. The attacks found so far hit government targets, so most home users are at low risk. Still, it is worth knowing about.
- Status
- Partly patched
- Being attacked?
- Yes[1]
- Severity
- Medium
- Updated
Kaspersky says it found BlackX used in a spying campaign against government offices in Central Asia in early 2026. Severity: NVD score 4.4 for the old bug it uses (CVE-2022-21894). Real attacks so far hit government targets. First reported .
Am I affected?
Probably not a big risk for a home computer, but it could be if your PC uses Secure Boot and the extra Microsoft step was never done. A read-only check is below. Ask an IT helper before you change anything, because the wrong steps can stop old recovery drives from working.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Windows 10 and 11 | Windows | Windows PCs with Secure Boot where Microsoft's extra 'revocation' step was never turned on | Microsoft's protection is in updates from July 9, 2024 and later, but it is NOT turned on by default. You must turn it on by following Microsoft's guide.[2] |
How to check your version
These checks only look. They do not change anything on your computer.
Windows 10 and 11 on Windows
Easy way: Start > Settings > Windows Update. Then click Update history to see recent updates.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber; Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOn
Extra check (Windows)
Is the old Windows start-up certificate already blocked? (True = blocked, False = not yet). Needs 'Run as administrator'.
Or type this in PowerShell (Admin)Read-only. It only reads the version and changes nothing.
[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011'
How to fix it
- First install all Windows updates (Settings > Windows Update).
- Make a backup of your important files.
- Read Microsoft's guide (link below) before changing anything. Microsoft warns that turning this on can make older start-up or recovery drives stop working.
- If you are not comfortable with these steps, ask an IT helper. Do not skip the backup.
- Run the read-only check to see if the change is already on.
More on each app: Is my Windows up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/windows-secure-boot-blackx-bootkit.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2022-21894
Sources
- ResearcherKaspersky Securelist: BlackX bootkit (Oct 22, 2026)
- MakerMicrosoft: Windows Boot Manager revocations for Secure Boot (KB5025885) (May 9, 2023)
- NVDNVD: CVE-2022-21894 (Jan 11, 2022)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.