Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware - CyberSecurityNews
Hackers have revived BlackLotus bootkit techniques in a new campaign called BlackX, bypassing Windows Secure Boot to deploy espionage malware against diplomatic organizations in Central Asia.
The new bootkit, named BlackX, appeared in attacks targeting agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Investigators linked the campaign to APT41 with medium confidence, leaving attribution short of confirmation. The finding was not simply another case of missing security updates.
Investigators found that affected computers were fully patched, but vulnerable boot components remained trusted because additional certificate revocation steps had not been completed. Earlier reporting on Windows boot manager downgrades explains how older, signed components can undermine protections on otherwise updated systems.
BlackX Exploitation Chain
Kaspersky researchers found that BlackX's exploitation chain closely resembles BlackLotus, although its implementation and later payloads differ. BlackX exploits CVE-2022-21894 (Baton Drop) to manipulate the startup trust chain after compromising a network and obtaining administrator privileges.
Installation separates the executable from an encrypted package containing required components, making recovery harder when responders cannot retrieve its companion file. The package writes components to system and UEFI partitions, then exploits Baton Drop to install custom Machine Owner Keys enabling attacker-controlled EFI files to load.
The bootkit subsequently injects a signed malicious driver into the Windows kernel. Its signing certificate has since been revoked.
Espionage Payloads
BlackX delivers two observed user-mode payloads. One is a remote-access Trojan capable of loading additional .NET code and exchanging instructions through Google Drive, OneDrive, or Yandex.Disk. Similar Google Drive command channels have appeared in separate APT41-linked reporting.
The second payload, OxiDLLRunner, uses an obfuscated DLL loaded through a legitimate executable. It decrypts a nearby data file containing shellcode and a Rust executable, then contacts command infrastructure to receive additional DLL plugins that execute in separate threads.
Protection Gap
The protection gap involved continued trust in vulnerable components signed under Windows Production PCA 2011. Installing updates did not automatically activate the required revocation on affected systems. Certificate expiration on October 19 also did not independently block existing binaries.
Microsoft's certificate expiration advisory explains that existing devices continue starting normally after expiration. Administrators should verify boot-trust revocations rather than relying only on update status. Revocation changes require compatibility planning because older recovery media and boot configurations may depend on certificates being removed.
Related
