BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, according to Kaspersky's technical report published this week.

The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices. Notably, BlackX is assessed to be an updated version of BlackLotus, a notorious bootkit first observed being advertised on cybercrime forums in late 2022 before its existence was officially confirmed by ESET in March 2023.

Exploiting Incomplete Patches

BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts. However, successful exploitation hinges on an attacker having administrator privileges or physical access to a target host.

Kaspersky researchers found that attackers are capitalizing on the fact that organizations have not carried out manual steps to apply Microsoft's Secure Boot revocation mitigations, such as adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX).

Installation and Payloads

On October 19, 2026, the certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted. Attackers deploy BlackX after breaching victim networks through an unspecified method and gaining administrator privileges. To install the bootkit, the threat actor drops files including inst.exe and an encrypted extensionless file containing installation requirements.

The UEFI payload injects a malicious driver into the Windows kernel, signed with a certificate from Wenjiang District Mingyu Network Technology Service Studio (now revoked). The driver attempts to tamper with endpoint security software and drops a user-mode payload for cyber espionage, including a remote access trojan and a malicious DLL called OxiDLLRunner.

APT41 Connections

BlackX's connections to APT41 stem from an ESET report in June 2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities. An interesting overlap is the presence of the "xdd" string in BlackX and the kernel implant used by FishMonger. The use of DLL sideloading to deploy payloads is another pattern common among Chinese-origin threat actors.

What's particularly notable is that the source code of BlackLotus has never entered the public domain, indicating that the threat actors behind BlackX either reverse-engineered the original bootkit or purchased its source code. "Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors," Kaspersky researchers noted.