BlackX UEFI Bootkit Bypasses Secure Boot Protections on Fully Patched Windows Systems

A newly discovered UEFI bootkit called BlackX has been used in cyberespionage attacks targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan. According to researchers at Kaspersky’s Securelist, the malware exploits a gap in the deployment of Secure Boot protections, demonstrating that installing Windows security updates does not always mean every required mitigation is active.

Published on October 22, 2026, the investigation describes BlackX as a bootkit sharing technical similarities with BlackLotus, a previously documented malware family capable of bypassing Secure Boot through the Baton Drop vulnerability, CVE-2022-21894.

What Is the BlackX UEFI Bootkit?

A UEFI bootkit is malware that interferes with a computer’s startup process, allowing malicious components to run before the operating system has fully loaded. This early execution can make detection and remediation more difficult.

Secure Boot is designed to help prevent unauthorised boot components from loading by checking digital signatures during startup. However, weaknesses in trusted boot components and incomplete security mitigations can undermine these protections.

Securelist reports that attackers deployed BlackX after gaining access to victims’ networks and obtaining administrator-level privileges. This is an important distinction: the investigation does not describe BlackX as a vulnerability that automatically compromises any fully patched computer over the internet.

Connection to BlackLotus and Baton Drop

BlackX reportedly shares design characteristics with BlackLotus, a UEFI bootkit previously associated with CVE-2022-21894, also known as Baton Drop.

The Securelist investigation describes an installer named inst.exe working alongside an encrypted file called PVMDIJGKAX2. The encrypted file contains installation components, making it more difficult for investigators to recover the complete payload by examining the installer alone.

Researchers found that BlackX uses the Baton Drop vulnerability to interfere with the normal Secure Boot trust process and enable attacker-controlled EFI components to load.

Figure: Historical advertisement for the BlackLotus UEFI bootkit, illustrating the earlier threat associated with Secure Boot bypass techniques. Source: Securelist.

The supplied screenshot relates to the earlier BlackLotus advertisement, not direct evidence of the BlackX infection itself. It should therefore be presented as historical context.

How BlackX Attempts to Evade Detection

According to Securelist, the bootkit loads a malicious driver into the Windows kernel. The driver attempts to interfere with security monitoring by disrupting process, thread and registry callbacks and tampering with Event Tracing for Windows (ETW).

ETW is a Windows mechanism used by applications and security tools to collect system activity. Interference with monitoring mechanisms can reduce defenders’ visibility into suspicious behaviour.

Researchers also described a file-hiding technique that can cause certain file requests to return a handle associated with the legitimate calc.exe process rather than the requested malicious file.

The bootkit reportedly delivers additional malware for espionage. One payload can load .NET code and use cloud storage services for command-and-control communications. Another, named OxiDLLRunner by researchers, decrypts a file called v8_context_snapshot.bin and launches a Rust payload.

Securelist linked the campaign to APT41 with medium confidence. This is a qualified assessment, not definitive proof of attribution.

Why Fully Patched Windows Systems Were Still Vulnerable

The investigation found that affected systems had received Windows updates. The remaining problem involved the activation of the relevant Secure Boot revocation.

The protection associated with the Baton Drop attack relies on revoking trust in vulnerable boot components signed using the Windows Production PCA 2011 certificate. According to Securelist, installing the relevant update did not automatically complete this revocation on the targeted systems.

Microsoft’s guidance for Secure Boot protections associated with CVE-2023-24932 likewise describes a phased process involving updated certificates, boot managers and firmware revocation settings. The process requires careful planning because revoking older boot components can affect recovery media and certain boot configurations.

Administrators should therefore verify the actual state of Secure Boot protections rather than assuming that an up-to-date Windows installation confirms every mitigation is enabled.

How Organisations Can Reduce the Risk

Security teams should take the following defensive measures:

• Review Secure Boot status: Verify that supported devices have the required protections and revocations applied.
• Follow official guidance: Use Microsoft’s current deployment instructions and consult device manufacturers where firmware compatibility is uncertain.
• Test before broad deployment: Validate changes on representative devices and confirm recovery media remains compatible.
• Investigate administrator access: Review suspicious privileged logins, unexpected system changes and signs of unauthorised access.
• Monitor endpoint security: Investigate unusual boot-related activity and evidence of interference with security monitoring.
• Prepare incident response: If a bootkit is suspected, involve qualified incident responders and follow trusted recovery procedures rather than relying solely on ordinary malware removal.

Microsoft warns that Secure Boot mitigation changes can affect system boot and recovery. Organisations should review the documented implications and test carefully before deploying changes across their environments.

Conclusion

The BlackX investigation highlights a critical distinction between installing a security update and completing all the mitigations required to enforce it.

For defenders, the lesson is to verify Secure Boot configuration and revocation status, maintain strong controls over administrator access, and investigate suspicious boot-related changes. Keeping Windows updated remains essential, but organisations must also confirm that the intended protections are actually active.

Sources

• Securelist: New BlackX UEFI Bootkit Exploiting Baton Drop
• Microsoft: Secure Boot Revocation Guidance for CVE-2023-24932