BlackX UEFI bootkit Bypasses Secure Boot on fully patched Windows

In early 2026, a UEFI bootkit tracked as BlackX infected fully patched Windows machines at diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan by exploiting weaknesses in Microsoft’s Secure Boot protections. Kaspersky identified the attacks and published its findings on Oct. 22, 2026, with Ars Technica reporting on Nov. 3, 2026. The compromised machines had received all available Windows updates, including Microsoft’s 2022 patch for the underlying vulnerability and later certificate updates, yet the bootkit still loaded malicious code before the operating system started.

Researchers linked the BlackX campaign to APT41 with medium confidence, a group also tracked as Brass Typhoon, Wicked Panda, and Barium. The threat actor’s primary objective was to undermine Windows startup defenses and third-party security solutions while maintaining long-term covert access, according to Kaspersky researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov.

Secure Boot verifies digital signatures of boot software before allowing it to execute, establishing a chain of trust that prevents unauthorized boot code. UEFI firmware starts when a computer is turned on and manages system configuration, hardware setup, and operating system preparation, while the boot manager resides on a small dedicated partition and is responsible for the initial loading of the OS. The Baton Drop flaw targets this boot manager, and BlackX exploited the vulnerability, tracked as CVE-2022-21894, to bypass Secure Boot and load malicious code before Windows started. Under certain conditions, the flaw also lets attackers extract BitLocker encryption keys.

The NVD published the CVE record on Jan. 11, 2022, and Microsoft scored it at 4.4 on the CVSS 3.1 scale because an attacker needs high privileges; Kaspersky says that score can understate the damage when attackers already hold administrator rights. Microsoft patched the flaw in 2022, issued an update in 2023 adding a new certificate that no longer trusted vulnerable boot managers, and provided the means in 2024 to revoke trust in the certificate used to sign older vulnerable Windows boot managers. However, the revocation does not happen automatically when the patch is installed; administrators must manually revoke trust in the Windows Production PCA 2011 certificate.

The affected machines had not run the manual steps needed to apply the extra Secure Boot revocations, Kaspersky said. The Windows Production PCA 2011 certificate expired on Oct. 19, 2026, but expiration alone did not stop vulnerable binaries from loading unless they were blocklisted. Kaspersky noted it is extremely uncommon for administrators to take manual action after applying a security update, which explains why patched fleets remained exposed.

BlackX injects a malicious kernel driver signed with a now-revoked certificate issued to Wenjiang District Mingyu Network Technology Service Studio. The driver disables process, thread, and registry callbacks and tampers with Event Tracing for Windows providers, undermining OS security monitoring. It also intercepts file-open requests and returns a handle to calc.exe instead of the requested file, a technique used to hide malicious components. BlackX installs custom Machine Owner Keys to load arbitrary EFI files on infected hosts and interfere with Secure Boot, letting attackers enroll custom MOKs and load arbitrary EFI files to bypass Secure Boot protections.

The bootkit deploys a remote access trojan that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control and file transfers. The RAT polls cloud storage and acts on files by suffix, such as to run a .NET method or transfer files of interest, and is equipped to collect system details. The installer, inst.exe, runs as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1, where Q46F6MDLI3RX2KV1 is the RC4 decryption key for an extensionless file named PVMDIJGKAX2 containing installation components; storing components in a separate encrypted file makes it harder for incident responders to recover the complete malware package.

The second-stage payload, OxiDLLRunner, is an OLLVM-obfuscated DLL sideloaded by googleupdate.exe, which Kaspersky identifies as a renamed jcef_helper.exe. OxiDLLRunner receives DLL plugins exporting a create_plugin function and executes them in separate threads, and it decrypts v8_context_snapshot.bin to launch a Rust payload that contacts archivetj[.]com. Some tampering procedures activate only when Kaspersky or Avast security products are present, but Kaspersky found them ineffective against its own products.

Kaspersky researchers said BlackX’s implementation is “remarkably similar” to BlackLotus, a UEFI bootkit that first appeared on cybercrime forums in late 2022 with a price of 5,000 US dollars. ESET confirmed BlackLotus in March 2023 and its ability to bypass Secure Boot on fully patched Windows 11 systems, making it the first publicly documented in-the-wild UEFI bootkit able to do so. BlackLotus source code was leaked in July 2023, but the release was incomplete, and Kaspersky found some BlackLotus samples contained code missing from the public repository but present in BlackX. This suggests the BlackX operator either reverse-engineered BlackLotus or purchased its source code, possibly taking advantage of the fact that few organizations manually activated the Baton Drop patch; BlackX differs from BlackLotus by deploying a different kernel driver and follow-on payloads.

Microsoft stated, “It is critical to note that a threat actor’s use of this bootkit is primarily a persistence and defense evasion mechanism,” and described BlackLotus use as not a first-stage payload or initial access vector, requiring prior privileged or physical access. Attackers deployed BlackX only after breaching victim networks and obtaining administrator rights, and researchers said it is not an initial access vector. Microsoft’s guidance for related mitigations describes multiple steps for deploying Secure Boot protections, and administrators should verify Secure Boot configuration and revocation status rather than assuming protection from installed Windows updates.

Microsoft warns that blocking older boot components can affect recovery media and other boot options, that the change cannot be reverted while using Secure Boot, and that dual-boot machines need every Windows install updated before revocation or one may fail to start. The KB5025885 guide configures the AvailableUpdates value beneath the Secureboot key and launches the existing Secure-Boot-Update scheduled task, while Microsoft’s guide for CVE-2023-24932 says mitigations are not enabled by default and must be applied in stages.

Microsoft planned an automatic Enforcement Phase to revoke the certificate, but Kaspersky said that stage had not been implemented when its findings were published. The date Microsoft begins automatic enforcement is unknown, leaving the manual revocation step in place.

Threats that run before Windows loads create visibility and prevention challenges for Windows-based endpoint security products. EDR may detect initial compromise, privilege escalation, malicious installation, or later behavior, and remains useful for investigation, alerting, containment, and response. However, BlackX exposes a weakness in relying exclusively on detecting malicious behavior after it begins.

No established evidence shows that BlackX is broadly deployed against ordinary businesses, and Kaspersky’s write-up gives no total number of BlackX victim organizations; the campaign’s scope is described only by country and sector. For broader context, the 2025 Verizon Data Breach Investigations Report found third parties were involved in 30 percent of analyzed breaches, up from 15 percent the previous year, and exploitation of vulnerabilities was the initial access vector in 70 percent of espionage-motivated breaches.

ESET’s June 2026 report on FishMonger, also tracked as Aquatic Panda and Earth Lusca, tied that group to the APT41 umbrella and documented SprySOCKS backdoor attacks on government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. ESET found limited indications that some SprySOCKS versions may include a UEFI bootkit component likely exploiting CVE-2023-24932, a downgrade attack that reintroduces CVE-2022-21894 by forcing the OS to boot using an older Microsoft-signed Windows Boot Manager. The xdd string appears in both BlackX and the FishMonger kernel implant, raising the possibility that BlackX was used in those attacks, and DLL sideloading to deploy payloads is a pattern extremely common among threat actors of Chinese origin, which is listed as a second clue pointing to China-aligned hackers behind BlackX. ESET acknowledged similarities between BlackX and its FishMonger research yet cannot confirm connections without comparing samples, and ESET described its finding as “limited indications of possible UEFI bootkit involvement.”