Cybersecurity researchers have uncovered a new UEFI bootkit that can bypass Windows Secure Boot even on fully patched computers when administrators have not completed an additional manual security step.
The malware, called BlackX, was discovered by Kaspersky during an espionage campaign targeting diplomatic organisations in Central Asia.
Victims included organisations in Tajikistan, Uzbekistan and Turkmenistan.
Kaspersky has linked the campaign with medium confidence to APT41, a threat group widely associated with Chinese state-backed cyber operations.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
BlackX Exploits Old Baton Drop Vulnerability
BlackX exploits CVE-2022-21894, a Secure Boot vulnerability commonly known as Baton Drop.
The flaw is not new.
It was previously exploited by the BlackLotus UEFI bootkit, which attracted attention after security researchers confirmed in 2023 that it could bypass Secure Boot protections.
Secure Boot is designed to stop unauthorised software from running before Windows starts.
A UEFI bootkit attacks below the operating system level.
That makes it particularly difficult to detect and remove because malicious code can begin running before Windows and conventional security software fully load.
BlackX uses Baton Drop to install custom Machine Owner Keys.
Those keys allow attackers to load unauthorised EFI files and interfere with the Secure Boot chain.
Kaspersky said BlackX’s exploitation method is remarkably similar to BlackLotus.
Researchers believe its developers may have reverse-engineered BlackLotus or obtained access to its source code.
Fully Patched Windows Machines Were Still Compromised
One of the most significant findings is that the affected computers were not simply running outdated Windows installations.
Kaspersky said the known victims had fully patched Windows systems.
The problem was that Microsoft’s complete mitigation for Baton Drop requires more than installing routine security updates.
The protection involves revoking the Windows Production PCA 2011 certificate used to sign vulnerable UEFI components.
That revocation is not automatically activated in all cases.
Administrators need to complete additional configuration steps before the vulnerable components are blocked.
Kaspersky argues that this creates an important gap because most system administrators expect a vulnerability to be addressed once normal updates have been installed.
Microsoft has previously explained that automatically revoking old Secure Boot certificates can create compatibility problems, including problems on some dual-boot systems.
That is one reason the mitigation has been rolled out cautiously.
The Windows Production PCA 2011 certificate expired on October 19, 2026, but Kaspersky says expiration by itself does not stop vulnerable binaries from loading.
The certificate must also be added to the appropriate Secure Boot blocklist.
Malware Targets Security Software
After bypassing Secure Boot, BlackX loads a malicious Windows kernel driver.
The driver is designed to interfere with security monitoring.
Researchers found that it disables or modifies process, thread and registry callbacks used by security products.
It also tampers with Event Tracing for Windows, a monitoring feature that helps security software observe system activity.
Some of BlackX’s routines specifically check whether Kaspersky or Avast products are installed.
The driver also attempts to protect the bootkit’s own files.
When a user or security tool tries to open certain malicious files, the malware can redirect the request and launch Windows Calculator instead.
That type of behaviour is designed to frustrate investigation and make the underlying bootkit harder to inspect.
BlackX Deploys Espionage Malware
The bootkit is not the final payload.
Its purpose is to establish persistent, deeply embedded access before deploying additional espionage tools.
Kaspersky identified a remote-access trojan that communicates through popular cloud-storage services including Google Drive, OneDrive and Yandex.Disk.
The malware can execute additional .NET payloads and upload or download files.
Researchers also identified another component called OxiDLLRunner.
It uses DLL sideloading and ultimately launches a Rust-based payload capable of downloading additional plugins.
The use of legitimate cloud services can make malicious traffic more difficult to distinguish from normal network activity.
APT41 Attribution Remains Probabilistic
Kaspersky attributed the operation to APT41 with medium confidence.
The assessment is based on technical similarities, development artefacts and attack techniques.
Researchers found identifiers also seen in activity associated with the FishMonger threat actor, which has previously been linked to APT41.
They also identified techniques commonly associated with Chinese-speaking threat groups, including DLL sideloading and particular obfuscation methods.
However, attribution in cyber operations is rarely definitive.
The findings show similarities with known activity but do not independently prove who operated every compromised system.
Microsoft has also emphasised that Baton Drop exploitation is not an initial-access technique.
Attackers generally need administrator-level or physical access to a device before they can deploy this type of bootkit.
What this means for you:
Installing normal Windows updates may not be enough to fully protect systems from some Secure Boot attacks. Organisations should verify that Microsoft’s Secure Boot revocation guidance has actually been applied rather than assuming patched Windows machines are automatically protected.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
