BlackX bootkit bypasses Secure Boot on patched Windows systems

Kaspersky researchers reported on October 22 that attackers used a UEFI bootkit named BlackX to target diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The bootkit uses Baton Drop, the Secure Boot bypass identified as CVE-2022-21894, which has a CVSS score of 4.4. Kaspersky assesses with medium confidence that the activity is linked to APT41, a China-linked state-sponsored group.

BlackX is built on BlackLotus, a bootkit first advertised on cybercrime forums in late 2022 and confirmed by ESET in March 2023. BlackLotus also exploited CVE-2022-21894, and Microsoft has said the malware is a persistence and defense evasion mechanism rather than an initial access vector. Microsoft patched the flaw, but its instructions also require manual revocation steps, such as placing the "Windows Production PCA 2011" certificate on the Secure Boot UEFI Forbidden List, or DBX. Many organizations have not completed that manual step. The certificate expired on October 19, 2026, but Kaspersky found that vulnerable binaries still load unless the certificate is placed in the blocklist.

The attackers install BlackX after already gaining administrator privileges on a compromised host, using an unspecified breach method. The installer, inst.exe, is launched with an encrypted file named PVMDIJGKAX2 and the RC4 key Q46F6MDLI3RX2KV1. It writes files to system and UEFI partitions and exploits CVE-2022-21894 in a way Kaspersky describes as remarkably similar to BlackLotus, installing Machine Owner Keys so attacker-controlled EFI files can load before Windows starts.

The kernel driver delivered by the bootkit was signed with a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio, and the issuer later revoked that certificate. The driver tampers with process, thread, and registry callbacks and with Event Tracing for Windows, and includes routines that target security products from Kaspersky and Avast; Kaspersky found those routines ineffective. It also drops espionage payloads: a remote access trojan that routes command-and-control traffic through Google Drive, OneDrive, and Yandex.Disk, and a malicious DLL called OxiDLLRunner that is sideloaded by a delivered googleupdate.exe and launches a Rust payload connecting to archivetj[.]com.

Kaspersky connects BlackX to FishMonger, a group also known as Aquatic Panda and Earth Lusca that operates under the APT41 umbrella. An ESET report from June 2026 said FishMonger used the SprySOCKS backdoor in attacks on government targets in Honduras, Taiwan, Thailand, and Pakistan from 2023 to 2024, and found limited indications that some versions carried a UEFI component likely exploiting CVE-2023-24932. BlackX and FishMonger's kernel implant share the string 'xdd,' and both campaigns use DLL sideloading, a technique common among Chinese-origin threat actors. Georgy Kucherin, a Kaspersky researcher, said that using commercial crimeware allowed the group to bypass Windows boot protections without building new tools.

Administrators should follow Microsoft's Secure Boot revocation guidance, place the Windows Production PCA 2011 certificate on the DBX, and verify that the revocation has taken effect on devices, while also checking for unauthorized MOK installations and unexpected EFI files.

Update, October 24, 2026

LavX News reports that the BlackX authors constructed the bootkit by reverse-engineering BlackLotus or acquiring its code, and that the code has never been publicly released. The same report adds that the remote access trojan is used to collect system data and upload files the attackers want, and that the Rust payload downloaded from archivetj[.]com fetches additional DLL plugins. LavX News also lists two detection steps beyond the earlier guidance: review endpoint logs for signs of tampering linked to revoked certificates, and look for command lines that launch inst.exe with an RC4 decryption key.

Update, October 24, 2026

BleepingComputer reported additional details from Kaspersky's analysis. The BlackLotus source code was leaked in July 2023, but that release was incomplete; Kaspersky found code in analyzed BlackLotus samples that does not appear in the public repository, yet does appear in BlackX. Because the code was unavailable in the leak, Kaspersky believes the operator either reverse engineered BlackLotus or purchased its source. Kaspersky also said every BlackX victim ran a fully patched Windows release. The bootkit's kernel driver intercepts attempts to open its files and instead launches Windows Calculator. The sideloaded OxiDLLRunner decrypts v8_context_snapshot.bin, and the resulting shellcode launches a Rust payload that retrieves DLL plugins from archivetj[.]com and runs their create_plugin functions in separate threads. The RAT uses Google Drive, OneDrive, or Yandex.Disk for command-and-control to execute .NET payloads and upload and download files.