BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Original title: Why a patched PC still loaded the BlackX bootkit, and how to check yours
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
On October 22, 2026, Kaspersky reported the BlackX UEFI bootkit on fully patched Windows machines at diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, tying it to APT41 with medium confidence. After gaining admin rights, attackers used Baton Drop (CVE-2022-21894) to install their own Machine Owner Keys, then loaded a driver that disables security callbacks, tampers with ETW and hides files. Microsoft's revocation of the Windows Production PCA 2011 certificate (KB5025885, CVE-2023-24932) ships disabled; a 2023 certificate showing Updated does not mean PCA 2011 is blocklisted.
Unconfirmed: Kaspersky ties BlackX to APT41 and a FishMonger link only with medium confidence.
- Kaspersky's GReAT team says it found the attack in early 2026.
- Installer inst.exe uses an RC4 file named PVMDIJGKAX2 and a Google Drive, OneDrive or Yandex.Disk RAT.
- NVD scores are 4.4 for CVE-2022-21894 and 6.7 for CVE-2023-24932; both need high privileges.
- AvailableUpdates 0x5944 does not include the 0x80 revocation or 0x200 SVN bits.
- The PCA 2011 certificate expired on October 19, 2026, but old signed files still load unless blocklisted.
Impact: Secure Boot bypass and persistent kernel-level access after admin compromise
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Windows Secure Boot | fully patched machines that have not applied the PCA 2011 revocation | KB5025885 revocation (AvailableUpdates 0x80), not enabled by default |
- 1.Check the firmware DBX blocked list, not only UEFICA2023Status = Updated.
- 2.Enable the KB5025885 revocation (AvailableUpdates 0x80) after backing up BitLocker keys.
- 3.Test one PC per model and make new recovery media before fleet-wide revocation.
- ATT&CK
- T1542.003 Pre-OS Boot: BootkitT1562.001 Impair Defenses: Disable or Modify ToolsT1071.001 Application Layer Protocol: Web Protocols
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41FishMonger
- Malware
- BlackXBlackLotusOxiDLLRunner
- Organizations
- Kaspersky
- Countries
- TajikistanUzbekistanTurkmenistan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% | ||
| CVE-2023-24932 | Secure Boot Security Feature Bypass Vulnerability | 6.7 | 11% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.archivetj.com | from the same folder. Command server for the Rust payload: www[.]archivetj[.]com. The RAT reads and writes files on Google Drive, OneDri |
| md5 | 0bcdf5e0da32d68900b8b7638459d072 | District Mingyu Network Technology Service Studio), serial 0bcdf5e0da32d68900b8b7638459d072. Kaspersky says the issuer has revoked it. Sideloading host |
| md5 | af8a983b9ada07eae1259bf2953abd40 | te.exe, which is really the legitimate jcef_helper.exe (MD5 AF8A983B9ADA07EAE1259BF2953ABD40). It loads the OxiDLLRunner DLL, which decrypts v8_context_ |
From the original article
13 min read at theainewsreport.com
The BlackX UEFI bootkit explained: why fully patched Windows PCs still loaded it, and how to check and apply the Secure Boot revocation Microsoft leaves off by default On October 22, 2026, Kaspersky reported BlackX, a UEFI bootkit it ties to APT41 with medium confidence, on fully patched Windows machines at diplomatic agencies in Central Asia. The fix that would have blocked it ships turned off.
By titusblair · theainewsreport.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.