BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Original title: BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
Kaspersky reports that a UEFI bootkit it calls BlackX was used in early 2026 against diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan. The company suspects China-linked APT41. BlackX reuses the BlackLotus method for CVE-2022-21894, which still works on patched Windows systems that have not applied Secure Boot DBX revocations, then loads a signed kernel driver and espionage payloads.
Unconfirmed: Attribution to APT41 is Kaspersky's suspicion based on overlaps with FishMonger, not a confirmed link.
- Install requires administrator privileges and files inst.exe plus encrypted PVMDIJGKAX2.
- The kernel driver was signed by Wenjiang District Mingyu Network Technology Service Studio; the issuer later revoked it.
- Payloads include a RAT using Google Drive, OneDrive, and Yandex.Disk, and OxiDLLRunner sideloaded by googleupdate.exe.
- Kaspersky says BlackLotus source was never public, so BlackX was likely reverse-engineered or bought.
Impact: Pre-OS persistence, Secure Boot bypass, and espionage payloads
| Product | Affected |
|---|---|
| Microsoft Windows | Patched systems missing Secure Boot DBX revocations |
- 1.Add the Windows Production PCA 2011 certificate to the Secure Boot DBX forbidden list.
- 2.Treat BlackX as post-compromise persistence that needs existing administrator or physical access.
- CVEs
- CVE-2022-21894
- ATT&CK
- T1542.003 Pre-OS Boot: BootkitT1574.002 Hijack Execution Flow: DLL Side-LoadingT1102 Web ServiceT1562.001 Impair Defenses: Disable or Modify Tools
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41
- Malware
- BlackXBlackLotusOxiDLLRunner
- Organizations
- Kaspersky
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | archivetj.com | ecrypts and launches a Rust payload that communicates with "archivetj[.]com" to receive and execute more DLL plugins. BlackX's connec |
From the original article
4 min read at thehackernews.com
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.