BlackX UEFI Bootkit Bypasses Secure Boot on Fully Patched Windows Systems - The420.in
Cybersecurity researchers have discovered BlackX, a new UEFI bootkit that can bypass Windows Secure Boot even on fully patched systems when administrators haven't completed an additional security step.
The malware, discovered by Kaspersky during an espionage campaign targeting diplomatic organizations in Central Asia, has compromised systems in Tajikistan, Uzbekistan, and Turkmenistan. Kaspersky has linked the campaign with medium confidence to APT41, a threat group widely associated with Chinese state-backed cyber operations.
Exploiting Old Vulnerability
BlackX exploits CVE-2022-21894, a Secure Boot vulnerability commonly known as Baton Drop. This flaw is not new and was previously used by the BlackLotus UEFI bootkit, which gained attention in 2023 for its ability to bypass Secure Boot protections.
Secure Boot is designed to prevent unauthorized software from running before Windows starts, but a UEFI bootkit attacks below the operating system level, making it particularly difficult to detect and remove. BlackX uses Baton Drop to install custom Machine Owner Keys that allow attackers to load unauthorized EFI files and interfere with the Secure Boot chain.
Patched Systems Still Vulnerable
Notably, the affected computers had fully patched Windows systems. The issue is that Microsoft's complete mitigation for Baton Drop requires more than routine security updates—it involves revoking the Windows Production PCA 2011 certificate used to sign vulnerable UEFI components, which isn't automatically activated in all cases.
Most system administrators expect a vulnerability to be addressed once normal updates have been installed.
Microsoft has explained that automatically revoking old Secure Boot certificates can create compatibility problems, including issues on dual-boot systems. The certificate expired on October 19, 2026, but expiration alone doesn't stop vulnerable binaries from loading—it must also be added to the Secure Boot blocklist.
Targeting Security Software
After bypassing Secure Boot, BlackX loads a malicious Windows kernel driver designed to interfere with security monitoring. It disables or modifies process, thread and registry callbacks used by security products and tampers with Event Tracing for Windows, a monitoring feature that helps security software observe system activity.
Some of BlackX's routines specifically check for Kaspersky or Avast products. The driver also attempts to protect the bootkit's own files by redirecting requests to open certain malicious files to launch Windows Calculator instead, frustrating investigation efforts.
Espionage Payload Deployment
The bootkit establishes persistent access before deploying additional espionage tools, including a remote-access trojan that communicates through cloud services like Google Drive, OneDrive, and Yandex.Disk. Another component called OxiDLLRunner uses DLL sideloading to launch a Rust-based payload capable of downloading additional plugins.
While Kaspersky attributed the operation to APT41 with medium confidence based on technical similarities and development artifacts, the company emphasized that attribution in cyber operations is rarely definitive. Microsoft also noted that Baton Drop exploitation requires administrator-level or physical access to a device before deployment.
Related
