BlackX bootkit uses Baton Drop to bypass Secure Boot
Original title: Hackers Use New BlackX Bootkit to Bypass Windows Secure Boot on Fully Patched Systems
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
Securelist reported on October 22, 2026, that a UEFI bootkit called BlackX was used in cyberespionage against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. BlackX is installed after attackers already have administrator rights and uses Baton Drop (CVE-2022-21894) to load attacker EFI files despite Secure Boot. A kernel driver disrupts security callbacks and ETW, and user-mode payloads include a remote-access Trojan and OxiDLLRunner. Securelist links the activity to APT41 with medium confidence, not as definitive attribution.
Unconfirmed: The APT41 link is Securelist’s medium-confidence assessment and is described as not definitive.
- The installer inst.exe works with an encrypted file named PVMDIJGKAX2.
- A reported command-and-control domain is www.archivetj.com; cloud storage is also used for C2.
- Revoking the Windows Production PCA 2011 certificate is separate from installing Windows updates.
- Securelist says that certificate’s October 19, 2026 expiration alone did not stop vulnerable binaries from loading.
- BlackX shares design parts with the BlackLotus bootkit.
Impact: Pre-Windows code execution and espionage after admin access
| Product | Affected |
|---|---|
| Microsoft Windows Secure Boot | — |
- 1.Verify Secure Boot revocation status, not only that Windows updates are installed.
- 2.Follow Microsoft’s Secure Boot revocation guidance and test recovery media first.
- 3.Hunt for inst.exe, PVMDIJGKAX2, googleupdate.exe, and tampered security callbacks.
- CVEs
- CVE-2022-21894
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41
- Malware
- BlackXOxiDLLRunnerBlackLotus
- Organizations
- Securelist
- Countries
- TajikistanUzbekistanTurkmenistan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.archivetj.com | v8_context_snapshot.bin Reported command-and-control domain www[.]archivetj[.]com Driver certificate serial number 0bcdf5e0da32d68900b8b7 |
| md5 | 0bcdf5e0da32d68900b8b7638459d072 | main www[.]archivetj[.]com Driver certificate serial number 0bcdf5e0da32d68900b8b7638459d072 The main lesson for defenders is to confirm that Secure Boo |
| md5 | af8a983b9ada07eae1259bf2953abd40 | name googleupdate.exe Original filename jcef_helper.exe MD5 AF8A983B9ADA07EAE1259BF2953ABD40 Related payload file v8_context_snapshot.bin Reported comma |
From the original article
4 min read at cybersecuritynews.com
A new UEFI bootkit called BlackX has been used in cyberespionage attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The malware targets Secure Boot, a feature designed to help stop untrusted software from running before Windows starts. Researchers say the infected computers had received Windows updates, but a key Secure Boot protection had not […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.