The BlackX UEFI bootkit bypassed Secure Boot during an espionage campaign targeting diplomatic agencies in Central Asia. Researchers discovered the operation in early 2026, with targets concentrated in Tajikistan, Uzbekistan and Turkmenistan.
Kaspersky linked the campaign to the Chinese state-sponsored group APT41 with medium confidence. However, that assessment does not establish attribution with certainty.
The malware exploited Baton Drop, an older vulnerability tracked as CVE-2022-21894. It then loaded a malicious Windows driver and additional espionage tools.
BlackX UEFI Bootkit Shares Features With BlackLotus
Researchers found strong similarities between BlackX and BlackLotus, another bootkit that exploited Baton Drop to defeat Secure Boot.
Secure Boot normally checks boot components before allowing them to run. However, vulnerable components can undermine that protection when systems continue trusting them.
According to Kaspersky, both bootkits use closely related methods to enrol attacker-controlled Machine Owner Keys. This allows malicious EFI components to load despite Secure Boot protections.
Nevertheless, BlackX uses a different kernel driver and different follow-on payloads.
Researchers believe its developers either reverse-engineered BlackLotus or obtained access to its source code beyond the public leak.
Although someone published BlackLotus source code in July 2023, that release was incomplete. BlackX contains code that researchers found in BlackLotus samples but not in the public repository.
Malicious Driver Targets Security Monitoring
BlackX loads a Windows kernel driver signed with a certificate that authorities have since revoked.
The certificate belonged to an organisation named Wenjiang District Mingyu Network Technology Service Studio.
Once active, the driver attempts to disable security processes and registry callbacks. It also interferes with Event Tracing for Windows, which security tools use to monitor system activity.
Some routines run only when the malware detects Kaspersky or Avast products. However, Kaspersky says the relevant interference mechanism does not work against its own solutions.
Additionally, the driver obstructs access to the bootkit’s files. When a user attempts to open them, it intercepts the request and launches Windows Calculator instead.
Espionage Payloads Use Cloud Services and DLL Loading
The driver also deploys tools that support remote access and further malware execution.
One payload is a remote access trojan that communicates through Google Drive, OneDrive or Yandex.Disk. It can execute .NET payloads and transfer files between the compromised computer and its operators.
Meanwhile, another component, OxiDLLRunner, uses DLL sideloading through a program named googleupdate.exe.
It decrypts a local file to launch shellcode and a Rust payload. That payload subsequently retrieves DLL plugins from an attacker-controlled server and runs them in separate threads.
Together, these components extend the intrusion beyond the boot process and support ongoing espionage.
Installed Updates Did Not Complete the Mitigation
According to Kaspersky, every identified BlackX victim ran a fully patched Windows release. However, administrators had not activated the additional Secure Boot revocations needed to block vulnerable boot components.
The researchers say installing the relevant updates alone did not automatically revoke trust in the Windows Production PCA 2011 certificate.
Consequently, systems could continue loading vulnerable components signed with that certificate despite having current Windows patches.
Kaspersky believes the attackers deliberately exploited this gap. The researchers argue that administrators rarely expect to complete manual security steps after installing an update.
Certificate Expiry Does Not Automatically Block Vulnerable Components
The Windows Production PCA 2011 certificate reached its expiration date on October 19, 2026, according to the researchers.
However, they warn that expiration alone does not prevent affected Windows systems from loading vulnerable signed binaries. Administrators must also apply the relevant revocation controls.
Microsoft provides guidance for revoking vulnerable Windows boot managers. The findings highlight the difference between installing security updates and completing the additional steps those updates require.
0 responses to “BlackX UEFI Bootkit Exploits Old Flaw to Bypass Secure Boot”