BlackX UEFI bootkit bypasses Secure Boot via Baton Drop CVE-2022-21894 on fully patched Windows: how do I check whether the boot manager revocations (DBX / Windows Production PCA 2011) are applied?

What it is: Kaspersky reported a UEFI bootkit, BlackX, attributed to APT41 and seen against diplomatic targets in Central Asia. It loads through the old Windows Boot Manager flaw CVE-2022-21894 ('Baton Drop'). The Windows update for that bug fixed the boot manager itself, but Secure Boot still trusts older, vulnerable boot managers signed with the 'Microsoft Windows Production PCA 2011' certificate unless the revocations from Microsoft's boot manager guidance (KB5025885, the BlackLotus mitigations) were applied by hand. Many fully patched machines never had them applied, so Secure Boot shows as on but can still be bypassed. Am I affected / how to check: - Secure Boot enabled machines where the KB5025885 mitigations were never turned on are exposed. In an elevated PowerShell, check whether the Windows Production PCA 2011 certificate has been added to the revocation list: [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match 'Microsoft Windows Production PCA 2011' (True means revoked). Also check that the 'Windows UEFI CA 2023' certificate is in db and that boot media were updated. - Your management tool or Microsoft's Secure Boot status reporting can show the same for a fleet. Fix: 1. Install current cumulative updates, then follow Microsoft's 'Revoking vulnerable Windows Boot Managers' guidance (KB5025885) in order: add the Windows UEFI CA 2023 certificate to db, update the boot manager, add the PCA 2011 revocation to DBX, and apply the SVN update. Test on a few devices first, since the revocation can stop old recovery media, PXE images and some dual-boot setups from booting. 2. Update recovery USBs, WDS/PXE and other boot media to boot managers signed by the 2023 CA before rolling out the revocation. 3. Keep firmware (BIOS/UEFI) current from the OEM. After: - For machines suspected of compromise, revoking alone is not cleanup: check the EFI System Partition for unexpected boot files, compare against known-good images, and reinstall from trusted media if in doubt. Rotate credentials used on the machine. - Watch for devices that fail to boot after the DBX update and fix their boot media rather than turning Secure Boot off. Sources: https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/ https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d