BlackX UEFI bootkit bypasses Secure Boot on patched Windows systems

Kaspersky researchers have analyzed BlackX, a UEFI bootkit used in an espionage campaign in early 2026 that bypassed Secure Boot on fully patched Windows machines, BleepingComputer reported on October 24. The security firm attributes the campaign with medium confidence to the China-linked APT41 group, also tracked as Brass Typhoon, Wicked Panda and Barium, and says the targets were diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The case matters because the attack worked against systems that had installed the relevant Windows patch but never applied the additional revocation steps.

What happened

According to BleepingComputer, BlackX exploits Baton Drop (CVE-2022-21894), the Secure Boot bypass that ESET found the BlackLotus bootkit abusing in 2023. Kaspersky describes BlackX's exploit as "remarkably similar" to BlackLotus's: it lets the attacker enroll custom Machine Owner Keys and load arbitrary EFI files during boot. Some BlackX code appears in BlackLotus samples but not in the incomplete BlackLotus source leak of July 2023, leading Kaspersky to believe the operator either reverse-engineered BlackLotus or obtained its source code.

Technical details

The bootkit drops a kernel driver signed with a now-revoked certificate issued to a Chinese company, BleepingComputer reported. The driver disables security processes and registry callbacks and tampers with Event Tracing for Windows (ETW) providers. It also guards the bootkit's files by launching Windows Calculator whenever someone tries to open them.

Kaspersky observed two follow-on payloads, according to the reports. The first is a remote access trojan that uses Google Drive, OneDrive or Yandex.Disk for command-and-control, runs .NET payloads and transfers files. The second, called OxiDLLRunner, is an obfuscated DLL sideloaded by googleupdate.exe that runs shellcode and a Rust payload which loads DLL plugins from a remote server.

Who is affected

The Hacker News notes that the bootkit succeeded against patched Windows systems that were missing the Secure Boot revocations. Kaspersky said that the revocation of the "Windows Production PCA 2011" certificate "does not happen automatically upon patch installation" and must be triggered manually, a step administrators rarely take. BleepingComputer adds that the certificate's October 19, 2026 expiration does not stop vulnerable boot binaries from loading unless they are explicitly added to the blocklist.

What to do

• Apply Microsoft's documented procedure for revoking vulnerable Windows boot managers, including the updated Secure Boot DBX entries, rather than relying on cumulative updates alone.
• Verify Secure Boot revocation status on high-value endpoints, particularly in government and diplomatic environments.
• Monitor for unexpected Machine Owner Key enrollments and unfamiliar EFI files on the system partition.
• Hunt for the payload behavior described by Kaspersky, such as cloud storage command-and-control traffic and DLL sideloading via googleupdate.exe.