● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems
Key points
- BlackX bootkit targets diplomatic entities in Central Asia.
- Suspected to be linked to China-backed APT41 group.
- Bypasses Secure Boot using the Baton Drop vulnerability (CVE-2022-21894).
- Exploits systems missing manual Secure Boot revocation steps.
- BlackX loads a malicious driver that interferes with Kaspersky and Avast security solutions.
- BlackX was discovered in early 2026.
- Targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan.
- BlackX's exploit implementation is similar to BlackLotus.
- BlackX infected fully patched Windows 11 systems.
- Microsoft did not revoke trust in digital certificates for vulnerable boot managers.
- BlackLotus was the first publicly documented in-the-wild UEFI bootkit to bypass Secure Boot on updated Windows 11.
- Microsoft patched the BlackLotus vulnerability in 2022.
- Microsoft added a new certificate in 2023 that no longer trusted vulnerable boot managers.
- Microsoft provided means to revoke trust in digital certificates for vulnerable boot managers in 2024.
BlackX Bootkit Targets Diplomatic Organizations
A new UEFI bootkit named BlackX has been identified targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Kaspersky attributes this activity to APT41, a China-linked state-sponsored hacking group. The primary goal of BlackX is to compromise Windows startup defenses and third-party security solutions to maintain covert access to devices.
Evolution of BlackLotus
BlackX is considered an updated version of BlackLotus, a bootkit first seen in late 2022 and confirmed by ESET in March 2023. BlackLotus exploited the Secure Boot bypass vulnerability CVE-2022-21894, also known as Baton Drop, to load malicious code before the operating system starts. Exploitation requires administrator privileges or physical access to the target.
Persistence and Evasion Mechanism
Microsoft previously stated that this bootkit acts as a persistence and defense evasion mechanism, not an initial access vector. It can only be deployed after an attacker has gained privileged or physical access to a device. The bootkit's effectiveness relies on its ability to bypass security measures once initial access is established.
Exploiting Unapplied Revocations
Kaspersky researchers found that BlackX capitalizes on organizations failing to complete manual steps required to fully address the Baton Drop vulnerability. While a patch exists, systems remain vulnerable if the "Windows Production PCA 2011" certificate is not manually added to the Secure Boot UEFI Forbidden List (DBX). This allows the vulnerable binaries to load even on patched systems, as the certificate's expiration on October 19, 2026, does not prevent loading unless blocklisted.
Updates
- BlackX infected fully patched Windows 11 systems.
- Microsoft did not revoke trust in digital certificates for vulnerable boot managers.
- BlackLotus was the first publicly documented in-the-wild UEFI bootkit to bypass Secure Boot on updated Windows 11.
- Microsoft patched the BlackLotus vulnerability in 2022.
- Microsoft added a new certificate in 2023 that no longer trusted vulnerable boot managers.
- Microsoft provided means to revoke trust in digital certificates for vulnerable boot managers in 2024.
- BlackX loads a malicious driver that interferes with Kaspersky and Avast security solutions.
- BlackX was discovered in early 2026.
- Targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan.
- BlackX's exploit implementation is similar to BlackLotus.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2022-218944.4 MEDIUM GitHub ldpreload/BlackLotus GitHub Wack0/CVE-2022-21894 CVE CVE-2023-249326.7 MEDIUMHow outlets covered it
A new UEFI bootkit, BlackX, infected fully patched Windows 11 systems by exploiting a vulnerability in the Windows boot manager. This occurred because Microsoft, despite patching the underlying flaw, did not revoke trust in the digital certificates used to sign older, vulnerable boot managers, allowing the malware to bypass Secure Boot.
A new UEFI bootkit, BlackX, was discovered in an espionage campaign targeting diplomatic agencies in Central Asia in early 2026. BlackX exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot, loading a malicious driver that interferes with security solutions from Kaspersky and Avast. This indicates a continued threat from bootkits leveraging known vulnerabilities for sophisticated attacks.
A new UEFI bootkit, BlackX, is targeting diplomatic organizations in Central Asia, bypassing Secure Boot on Windows systems. BlackX exploits the Baton Drop vulnerability (CVE-2022-21894) on systems that have not applied manual Secure Boot revocation mitigations, even if patched.