Malware · Vulnerabilities
BlackX bootkit lets attackers bypass Secure Boot on patched Windows systems
A new bootkit called BlackX has been used to bypass Secure Boot on fully patched Windows systems, targeting diplomatic agencies in Central Asia. The attack works when administrators have not completed manual steps required after patching a known flaw.
Ross Grant3 min read
The short version
A new type of malware called BlackX was found targeting government computers in Central Asia. It can get around a key Windows security feature called Secure Boot, even on systems that have been patched, if administrators have not done extra manual steps. The attack lets hackers install their own software before Windows starts. Security experts say many organisations are still at risk if they have not followed all the steps to fully fix the problem.
What happened?
A new UEFI bootkit called BlackX was used in early 2026 to bypass Secure Boot on Windows systems in Central Asia, targeting diplomatic agencies. The attack exploited the Baton Drop vulnerability, which remains exploitable if administrators have not manually added a specific certificate to the Secure Boot blocklist, even after patching. Researchers attribute the campaign to the China-linked group APT41, but this has not been confirmed by primary sources.
Who is affected
Diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan were targeted by the BlackX bootkit in early 2026, according to Kaspersky (opens in a new tab) and BleepingComputer (opens in a new tab). The attacks focused on government and diplomatic agencies, but the underlying flaw could affect any Windows system where Secure Boot revocation steps have not been completed.
How the flaw works
BlackX exploits a vulnerability known as Baton Drop (CVE-2022-21894), which allows attackers to bypass Secure Boot protections. Secure Boot is a security feature that ensures only trusted software runs when a computer starts. Microsoft released a patch for Baton Drop, but fully closing the hole requires administrators to manually add a specific certificate (the "Windows Production PCA 2011") to the Secure Boot forbidden list (DBX). Many organisations have not done this, leaving them exposed even after patching.
The certificate expired on 19 October 2026, but unless it is blocklisted, vulnerable components can still be loaded. Attackers are taking advantage of this gap in the update process.
How the attack worked
Attackers first gained administrator privileges or physical access to the target systems. They then deployed the BlackX bootkit, which is an updated version of the earlier BlackLotus bootkit. The installer drops an encrypted file and uses a command-line tool to decrypt and install the bootkit. The malware then installs Machine Owner Keys (MOKs) to load arbitrary EFI files, bypassing Secure Boot.
Once installed, BlackX injects a malicious driver into the Windows kernel. This driver, signed with a now-revoked certificate, tries to disable endpoint security software (notably from Kaspersky and Avast), although Kaspersky says these attempts are ineffective against its products. The driver also protects the bootkit’s files by intercepting attempts to open them and launching the Windows Calculator instead.
The bootkit then drops espionage tools, including a remote access trojan (RAT) that uses cloud storage services like Google Drive, OneDrive and Yandex.Disk for command and control. Another payload, OxiDLLRunner, is sideloaded by a legitimate process and launches further malicious code.
Who is behind it
Kaspersky and BleepingComputer attribute the campaign to APT41, a China-linked state-sponsored group, with medium confidence. The assessment is based on code similarities and known tactics, but no primary source has confirmed this.
The response
Researchers stress that simply applying Microsoft's patch for Baton Drop is not enough. Administrators must also follow manual steps to add the expired certificate to the Secure Boot blocklist. This is not done automatically during patching, and the lack of awareness has left many systems vulnerable. Instructions for fully patching the flaw are available, but uptake appears low.
What you should do
If you manage Windows systems, check whether the Secure Boot forbidden list (DBX) includes the "Windows Production PCA 2011" certificate. If not, follow Microsoft's guidance to add it and fully close the Baton Drop vulnerability. This step is essential even if you have already applied the security patch.
Claimed vs confirmed
- Unconfirmed
APT41 is behind the BlackX campaign.
Kaspersky and BleepingComputer attribute the attack to APT41 based on code similarities, but no primary source or authority has confirmed this.
Why it matters
This attack shows that patching alone is not always enough to secure systems. Manual steps are sometimes required, and attackers are quick to exploit gaps in the update process. Organisations that rely on Secure Boot for protection should check their systems for full compliance.
Key points
- BlackX bootkit bypasses Secure Boot on patched Windows systems if manual revocations are missing.
- The attack targeted diplomatic agencies in Central Asia in early 2026.
- Attackers used administrator access to install the bootkit and deploy espionage tools.
- Microsoft's patch for Baton Drop is not enough without manual certificate revocation.
- The campaign is attributed to APT41, but this is not confirmed by primary sources.
Sources
The Hacker News
Reference
BleepingComputer
Reference
