Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

BlackX UEFI Bootkit Slips Past Secure Boot on Patched Windows Machines

A new UEFI bootkit modelled on BlackLotus is hitting diplomatic targets in Central Asia. It works on fully patched Windows systems where the Baton Drop revocations were never applied.

4T4Tify Team4Tify
Oct 24, 2026·5 min read
BlackX UEFI Bootkit Slips Past Secure Boot on Patched Windows Machines

BlackX UEFI Bootkit Slips Past Secure Boot on Patched Windows Machines

A newly identified UEFI bootkit called BlackX has been used against diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan since early 2026. Its goal is to start before Windows does, switch off the operating system's boot protections and security tools, and keep long-term, hidden access to the machine. The activity is suspected, not confirmed, to be the work of a China-linked state-sponsored group tracked as APT41.

What happened

BlackX appears to be an updated copy of BlackLotus, the bootkit that was sold on cybercrime forums in late 2022. Like BlackLotus, it abuses CVE-2022-21894 ("Baton Drop"), a Secure Boot bypass in the Windows Boot Manager.

Microsoft fixed that flaw years ago, but installing the update was not enough. To fully close the hole, administrators also had to revoke the vulnerable boot binaries manually, and many organisations never took that step. A signing certificate behind those binaries expired on 19 October 2026, but expiry alone does not stop them from loading. Only an explicit blocklist entry does. BlackX relies on exactly this gap.

BlackLotus's source code was never made public. So whoever built BlackX either reverse-engineered the original or bought the code. It is unusual to see a state-aligned espionage group reuse a criminal tool like this.

The infection chain observed so far:

  • Attackers first break into the network by an unknown route and gain administrator rights.
  • They drop an installer, inst.exe (seen under C:\ProgramData\Intel\), along with an encrypted file called PVMDIJGKAX2 that has no extension. The installer runs with an RC4 key passed on the command line.
  • Files are written to both the system and the EFI partitions. Baton Drop is then used to enrol attacker-controlled Machine Owner Keys (MOK), so arbitrary EFI files can load and Secure Boot stops protecting the machine.
  • The UEFI stage loads a malicious kernel driver. It was signed with a certificate that has since been revoked, and it tries to disable endpoint security products, much like a bring-your-own-vulnerable-driver (BYOVD) attack.
  • The driver then deploys espionage payloads. One is a remote access trojan that uses Google Drive, OneDrive and Yandex.Disk for command-and-control so its traffic blends in with normal business use. Another is a DLL named OxiDLLRunner, sideloaded by a legitimate googleupdate.exe, which loads a Rust payload that talks to archivetj[.]com.

A shared xdd string and the use of DLL sideloading point to a link with earlier UEFI-assisted campaigns attributed to the APT41 umbrella. Treat that as a lead, not a verdict.

Why it matters

A bootkit runs before the operating system and its defences. Reinstalling Windows does not remove it, and EDR tools can easily miss it. The bigger lesson is that a machine can show as "patched" and still be exposed. Systems where the Baton Drop revocations were never applied remain open to this whole class of bootkits, and BlackX shows that capable attackers are actively looking for them.

What to do

  1. Apply the Secure Boot revocations, not just the patch. Follow Microsoft's guidance for CVE-2022-21894 and CVE-2023-24932. Update the DBX revocation list and the boot manager mitigations across your fleet, and confirm the change actually took effect.
  2. Audit enrolled Machine Owner Keys and the EFI System Partition. Look for unexpected MOK entries and for unfamiliar EFI binaries.
  3. Hunt for the indicators above: inst.exe in C:\ProgramData\Intel\, an extensionless PVMDIJGKAX2 file, googleupdate.exe loading DLLs from unusual paths, and traffic to archivetj[.]com.
  4. Watch for cloud storage used as command-and-control. Treat servers or workstations that talk to Google Drive, OneDrive or Yandex.Disk without a business reason as suspicious.
  5. Lock down administrator rights. BlackX needs admin access before it can install, so privileged account hygiene and early detection of lateral movement remain your first line of defence.

Gaps like a missing revocation are easy to overlook because the patch status looks clean. Our vulnerability scanning service looks past the patch level to firmware and boot-chain configuration, and flags systems that still need hardening before an attacker finds them.

SHARE