{"id":3750,"date":"2026-10-23T19:50:49","date_gmt":"2026-10-23T19:50:49","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3750"},"modified":"2026-10-23T19:50:49","modified_gmt":"2026-10-23T19:50:49","slug":"blackx-uefi-bootkit-bypasses-secure-boot-on-patched-windows-systems-missing-revocations","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3750","title":{"rendered":"BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations"},"content":{"rendered":"
\n
<\/a><\/div>\n

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX<\/strong>.<\/p>\n

The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report<\/a> published this week.<\/p>\n

The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.<\/p>\n

Notably, BlackX is assessed to be an updated version of BlackLotus, a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023.<\/p>\n

BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894<\/a> (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts. However, successful exploitation hinges on an attacker having administrator privileges or physical access to a target host.<\/p>\n

\u00abIt is critical to note that a threat actor’s use of this bootkit is primarily a persistence and defense evasion mechanism,\u00bb Microsoft noted<\/a> at the time. \u00abIt is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access.\u00bb<\/p>\n

That said, completely addressing the threat requires additional actions beyond installing the latest update, including running manual steps<\/a> to apply Microsoft’s Secure Boot revocation mitigations, such as adding<\/a> the \u00abWindows Production PCA 2011\u00bb certificate to the Secure Boot UEFI Forbidden List (DBX).<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The Russian cybersecurity company has found that attackers are capitalizing on the fact that organizations have not carried out these manual steps, enabling them to still use the Baton Drop vulnerability even on systems that have the \u00abpatch\u00bb applied.<\/p>\n

\u00abOn October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted,\u00bb researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov said.<\/p>\n

\u00abIt is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit.\u00bb<\/p>\n

Attackers have been observed deploying BlackX after breaching victim networks through an unspecified method and gaining administrator privileges. To install the bootkit, the threat actor drops the following files –<\/p>\n