BlackX bootkit bypasses Secure Boot on patched Windows; apply manual revocations
Kaspersky reports the BlackX UEFI bootkit, a modernized successor to BlackLotus, exploiting the Baton Drop flaw (CVE-2022-21894) against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The bootkit bypasses Secure Boot even on fully updated Windows machines, because protection requires manually enabling the Windows Boot Manager revocations associated with CVE-2023-24932, and automatic enforcement has not shipped. Apply the registry flag and the Secure-Boot-Update scheduled task from Microsoft's guide; Kaspersky attributes the campaign to APT41 with medium confidence.
What happened
Kaspersky discovered the BlackX bootkit in early 2026 attacks on diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan, and says its solutions prevented the attacks. The malware runs before Windows starts, bypasses Secure Boot, and disables security solutions. Kaspersky attributes the campaign to APT41 with medium confidence.
Why it matters
The bootkit gives invisible, long-term access to machines and opens the way for espionage that steals data through cloud services such as Google Drive, OneDrive, and Yandex Disk. Organizations running Windows with Secure Boot that have not applied Microsoft's manual revocations remain vulnerable even with every patch installed.
What to do
Run the manual steps in Microsoft's guide to enable the Windows Boot Manager revocations associated with CVE-2023-24932: the registry flag and the Secure-Boot-Update scheduled task. Automatic enforcement has not shipped yet. Restrict administrative privileges and monitor firmware integrity, as Kaspersky recommends.
For the technical team
- CVE
- CVE-2023-24932, CVE-2022-21894
- Affected
- Microsoft Windows Secure Boot (Windows Boot Manager assinado pelo Windows Production PCA 2011) · Windows machines with Secure Boot where the Windows Production PCA 2011 certificate has not been added to the Secure Boot DBX, even when fully updated (Microsoft guide).
- Exploitation
- Exploitation in real attacks reported by Kaspersky: an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. No publicly known attacks have used BlackLotus since the 2023 updates. Kaspersky attributes the campaign to APT41 with medium confidence.
- Fix
- Manually enable Microsoft's Windows Boot Manager revocations associated with CVE-2023-24932: registry flag plus the Secure-Boot-Update scheduled task, per Microsoft's guide; the automatic enforcement phase has not shipped. Kaspersky recommends restricting administrative privileges and monitoring firmware integrity, and cites its Exploit Prevention component as blocking exploitation even without the patch applied.
- Vector
- UEFI bootkit exploiting the Baton Drop vulnerability (CVE-2022-21894) to install custom Machine Owner Keys (MOK) and load arbitrary EFI files, manipulating Secure Boot. Conditions: attackers had already compromised the victim network and obtained administrator privileges; the installer inst.exe RC4-decrypts the package PVMDIJGKAX2. The flaw works on machines where the Windows Production PCA 2011 certificate has not been added to the Secure Boot DBX, even when updated.
- More details
- The kernel-injected driver differs from BlackLotus's; it disables process, thread, and registry callbacks of security solutions, tampers with ETW providers, and protects bootkit files by returning a handle to calc.exe; the procedures targeting Kaspersky and Avast failed to affect Kaspersky products. Two user-mode payloads: a RAT that loads further-stage .NET payloads and uses Google Drive, OneDrive, and Yandex.Disk as C2 (task suffixes 0X01 through 0X06 and SSSR), and OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by googleupdate.exe, which decrypts v8_context_snapshot.bin and runs a Rust payload that communicates with the www[.]archivetj[.]com C2 and executes DLLs exporting create_plugin. BlackLotus source code was never published; Kaspersky assesses the attackers reverse-engineered it or bought the code. Attribution basis: the identifier 'xdd' used repeatedly in payloads, ESET's June 2026 post on the FishMonger actor (assumed by the community to relate to APT41), plus OLLVM and DLL sideloading, patterns common among Chinese-speaking actors. Timeline: BlackLotus advertised in October 2022 for $5,000; ESET confirmed samples in March 2023; Kaspersky identified BlackX in early 2026; research presented at Security Analyst Summit 2026 in Bali, with press release on October 21, 2026.
Timeline
Kaspersky reports the BlackX bootkit in real attacks and Microsoft details the manual revocation.
Sources 6 sources
- How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 Microsoft
- New BlackX UEFI bootkit exploiting Baton Drop Kaspersky Securelist
- Kaspersky discovers BlackX bootkit targeting diplomatic organizations in Central Asia Kaspersky
- NVD: CVE-2022-21894 NVD
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations The Hacker News
See all 6 sources
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot BleepingComputer
