BlackX UEFI Bootkit Bypasses Secure Boot on Patched Systems Missing Revocations

Diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan faced targeted attacks in early 2026 using BlackX, a sophisticated UEFI bootkit that Kaspersky attributes to China-linked APT41. BlackX is an updated variant of BlackLotus, a bootkit first advertised in cybercrime forums in 2022. The malware’s core purpose is to undermine Windows startup defenses and security software while establishing persistent, covert access to compromised hosts.

The campaign exploits a critical gap between software patches and complete security remediation. BlackX leverages CVE-2022-21894, a Secure Boot bypass that Microsoft patched but only truly mitigated through manual revocation steps—specifically adding the “Windows Production PCA 2011” certificate to the Secure Boot forbidden list. Many organizations installed the patch but never performed these manual procedures, leaving systems vulnerable. A certificate central to the exploit expired in October 2026, yet expiration provides no protection without explicit blocklisting, allowing attackers to continue loading malicious binaries.

The bootkit deploys a kernel driver to disable endpoint security and launch espionage payloads. A remote access trojan routes commands through cloud storage services to blend with normal traffic, while a second payload abuses a legitimate Google updater binary to sideload a malicious DLL that executes encrypted Rust code. Notably, BlackLotus source code was never publicly released, suggesting BlackX’s developers either reverse-engineered the original bootkit or purchased its code—illustrating how state-sponsored actors efficiently weaponize existing crimeware to maintain control over high-value networks.