BlackX Bootkit Revives BlackLotus to Slip Past Windows Secure Boot

A new UEFI bootkit is borrowing the BlackLotus playbook to get underneath Windows Secure Boot and plant espionage malware on government machines. Tracked as BlackX, it surfaced in early 2026 in intrusions at diplomatic and state agencies in Tajikistan, Uzbekistan and Turkmenistan. The uncomfortable detail: the compromised systems were fully patched.

What happened

BlackX is not an initial-access tool. Operators deploy it after they already hold administrator rights on a network and use it to deepen and entrench the compromise. How those networks were first breached is still unknown.

Once on a host, the bootkit abuses Baton Drop, the Secure Boot bypass tracked as CVE-2022-21894, to tamper with the startup trust chain. It writes its components to the system and EFI partitions, registers attacker-controlled Machine Owner Keys and uses them to get its own EFI binaries loaded before the operating system starts. From there it injects a kernel driver signed with a legitimate certificate, since revoked, which tries to disable security callbacks and interfere with Event Tracing for Windows so endpoint sensors see less. Any attempt to read its protected on-disk files is quietly redirected to a harmless Windows binary. Not every one of its anti-security routines worked in testing, but the intent is clear.

The installer carries no malicious payload of its own. The real components sit in a separate encrypted package, so if responders recover the installer but not its companion file, there is little left to analyse.

Two user-mode payloads have been observed:

• A .NET remote-access trojan that loads additional .NET code and exchanges tasks and results through Google Drive, OneDrive or Yandex.Disk, letting command traffic hide inside ordinary cloud usage.
• OxiDLLRunner, an obfuscated DLL side-loaded by a renamed legitimate executable. It decrypts a nearby data file into shellcode and a Rust implant that fetches further DLL plugins from its command infrastructure.

Attribution points to APT41 with medium confidence, based on shared developer artefacts, overlaps with earlier FishMonger activity, familiar DLL side-loading habits and OLLVM obfuscation. That is a lead, not a verdict. Whether the authors reverse-engineered BlackLotus or bought its source code remains unconfirmed.

Why it matters

The chain closely mirrors BlackLotus, a bootkit first advertised on underground forums in 2022. That it still works in 2026 is the real story. The fix for Baton Drop needs more than a Windows update: the old boot components signed under the Windows Production PCA 2011 certificate have to be explicitly revoked on each device, and that step does not happen automatically. The certificate's own expiry on 19 October changed nothing either, because binaries that were already signed keep booting after expiry.

So a machine can report "fully patched" and still trust exactly the boot manager an attacker needs. A bootkit that loads before Windows survives operating-system reinstalls, blinds EDR from below and is very hard to spot from inside the running system. For embassies and ministries that is a quiet, durable foothold.

What to do

• Check boot-trust state, not update status. Confirm that the Secure Boot forbidden-signature database (DBX) on each Windows device actually contains the revocations for the 2011 CA and the vulnerable boot managers.
• Roll out the revocation deliberately. Older recovery media, boot images and dual-boot setups may depend on the certificates being removed, so test before applying at scale.
• Keep administrator rights scarce. BlackX only arrives after an attacker already holds admin privileges; tight privilege management and lateral-movement monitoring break the chain earlier.
• Watch for the trade-craft. Alert on unexpected changes to the EFI system partition, new Machine Owner Keys, drivers with revoked certificates, and endpoints talking to consumer cloud storage they have no business reason to use.
• Hunt with the known indicators listed below.

Known indicators (defanged):

• Installer path: C:\ProgramData\Intel\inst.exe
• Encrypted package name: PVMDIJGKAX2
• Revoked driver certificate serial: 0bcdf5e0da32d68900b8b7638459d072
• Side-loading hosts: googleupdate.exe, jcef_helper.exe (legitimate loader MD5 AF8A983B9ADA07EAE1259BF2953ABD40)
• Encrypted Rust payload: v8_context_snapshot.bin
• Command-and-control domain: www[.]archivetj[.]com
• Developer artefact: user name xdd (C:\Users\xdd\Desktop)
• Plugin export: create_plugin

This campaign is a reminder that "patched" and "protected" are not synonyms. Our vulnerability scanning service is built for exactly this gap: it looks at whether a fix is actually enforced on the host, not just whether an update was installed, so a boot chain that still trusts a revoked certificate gets flagged before someone else finds it.