A new UEFI bootkit called BlackX has been used in a cyberespionage campaign against diplomatic agencies in Central Asia, exploiting an old Secure Boot bypass on machines that were, by the usual measure, fully patched. Kaspersky researchers published their analysis on October 22, saying they identified the attack in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, and attributed it to the China-linked group APT41 with medium confidence. BleepingComputer and The Hacker News reported the findings this week.
BlackX closely resembles BlackLotus, the bootkit first advertised on a hacking forum in October 2022 for 5,000 dollars and confirmed by ESET in March 2023. Like BlackLotus, BlackX exploits Baton Drop, tracked as CVE-2022-21894, a Secure Boot security feature bypass in Windows boot components. Kaspersky called BlackX's implementation of the exploit remarkably similar to BlackLotus's, allowing the attackers to install custom Machine Owner Keys and load arbitrary EFI files before Windows starts, despite Secure Boot.
The resemblance is a puzzle. The original BlackLotus source code was never published, and a version leaked in July 2023 was incomplete. Because code in BlackLotus samples and in BlackX was missing from that leak, Kaspersky believes the operators either reverse-engineered BlackLotus or purchased its source from cybercriminals, a borrowing they say is rarely seen.
Attackers deploy BlackX only after compromising a network and gaining administrator privileges, so it is a persistence and defense evasion tool, not an initial access vector. Its installer, inst.exe, carries no malicious strings of its own. Everything needed for installation sits in a second file, PVMDIJGKAX2, encrypted with RC4, which makes recovery of its components harder for responders.
Once installed, the bootkit injects a malicious driver into the Windows kernel. The driver, signed with a certificate that has since been revoked, disables process, thread and registry callbacks used by security software and tampers with Event Tracing for Windows providers. Some routines run only when Kaspersky or Avast products are present, though Kaspersky said those procedures failed to interfere with its own products in testing. The driver also protects the bootkit's files, intercepting attempts to open them and returning a handle to the Windows Calculator instead.
The driver then deploys espionage payloads. One is a remote access trojan using Google Drive, OneDrive or Yandex.Disk for command and control, which can run further .NET payloads and move files. The second, OxiDLLRunner, is sideloaded by a legitimate executable and launches a Rust payload that can receive DLL plugins from a command server.
The central lesson is about the patch itself. The fix for Baton Drop is designed to revoke the Windows Production PCA 2011 certificate used to sign the vulnerable components, but that revocation does not happen automatically when the update is installed. An administrator must set a registry flag and run a scheduled task called Secure-Boot-Update to activate it. Microsoft's planned automatic Enforcement Phase had not been implemented when Kaspersky published, and the certificate's expiration on October 19, 2026 does not stop the vulnerable binaries from loading unless the certificate is blocklisted.
For IT teams, the practical step is to verify that the manual revocation — adding that certificate to the Secure Boot UEFI Forbidden List, known as DBX — has actually been applied across the fleet, rather than assuming an installed update finished the job. A machine can report itself fully patched and still trust the boot components BlackX abuses.