BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Original title: Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
Investigators found the BlackX bootkit in early 2026 attacks on diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. After attackers already have administrator rights, BlackX abuses CVE-2022-21894 to install custom Machine Owner Keys, load attacker EFI files, and inject a since-revoked driver. Payloads include a cloud-controlled remote-access trojan and OxiDLLRunner, which runs a Rust executable and extra DLL plugins. Kaspersky's October 22 Securelist report rates an APT41 link as medium confidence.
Unconfirmed: APT41 attribution is medium confidence only, and the report does not establish the initial breach.
- The installer is split from an encrypted package and contains no embedded payloads.
- The driver tried to disable security callbacks and interfere with Event Tracing for Windows.
- One payload exchanges instructions through Google Drive, OneDrive, or Yandex.Disk.
- Certificate expiration on October 19 did not by itself block existing binaries.
- Researchers cite a revoked driver certificate and the defanged domain www[.]archivetj[.]com.
Impact: Secure Boot bypass, kernel driver load, and espionage access
| Product | Affected |
|---|---|
| Microsoft Windows | — |
- 1.Verify boot-trust certificate revocations instead of relying only on update status.
- 2.Hunt for the reported installer path, loader names, and revoked driver certificate.
- CVEs
- CVE-2022-21894
- ATT&CK
- T1542.003 BootkitT1562.001 Disable or Modify ToolsT1102.002 Bidirectional CommunicationT1574.002 DLL Side-Loading
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41FishMonger
- Malware
- BlackXBlackLotusOxiDLLRunner
- Organizations
- Kaspersky
- Countries
- TajikistanUzbekistanTurkmenistan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.archivetj.com | ad v8_context_snapshot.bin Rust payload container C2 domain www[.]archivetj[.]com Rust payload communications Development marker xdd ; C: |
| md5 | 0bcdf5e0da32d68900b8b7638459d072 | key Q46F6MDLI3RX2KV1 Package decryption Certificate serial 0bcdf5e0da32d68900b8b7638459d072 Revoked driver certificate Loader names googleupdate.exe ; |
| md5 | af8a983b9ada07eae1259bf2953abd40 | ; jcef_helper.exe Renamed legitimate executable Loader MD5 AF8A983B9ADA07EAE1259BF2953ABD40 Legitimate loader hash Encrypted payload v8_context_snapsho |
From the original article
3 min read at cybersecuritynews.com
Hackers have revived techniques associated with the BlackLotus bootkit to bypass Windows Secure Boot and deploy espionage malware against diplomatic organizations in Central Asia. The new bootkit, named BlackX, appeared in attacks targeting agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Investigators linked the campaign to APT41 with medium confidence, leaving attribution short of […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.