BlackX: China-Linked Bootkit Slips Past Secure Boot on "Patched" Windows

Kaspersky has published a technical report on BlackX, a new UEFI bootkit used in early 2026 against diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan. The campaign is attributed to APT41, a China-linked state-sponsored group.

BlackX is not a first-stage tool but a persistence and defense-evasion mechanism: it undermines Windows startup protections and third-party security products to keep long-term, covert access. It is assessed to be a successor to the notorious BlackLotus, advertised on crime forums in late 2022 and confirmed by ESET in March 2023.

An old hole never fully closed

BlackLotus exploits the now-patched Secure Boot bypass CVE-2022-21894, also known as Baton Drop. But a single update is not enough: operators must manually apply revocation mitigations, notably adding the "Windows Production PCA 2011" certificate to the Secure Boot Forbidden List (DBX). Many organizations skipped that step — and the attackers exploited exactly that gap.

The certificate expired on October 19, 2026, yet expiry alone does not stop vulnerable binaries from loading until the certificate is blocklisted. Researchers believe the actors deliberately studied how BlackLotus works and built a copycat, betting that few would complete the patch.

How the attack unfolds

With admin rights already in hand, the attackers drop an installer, inst.exe, and an encrypted file, PVMDIJGKAX2, launching installation from C:\ProgramData\Intel with an RC4 key. Files are then written to system and UEFI partitions to exploit the flaw in a manner "remarkably similar" to BlackLotus. The goal is the same: install Machine Owner Keys and interfere with Secure Boot.

Notably, BlackLotus source code never went public, so BlackX's authors either reverse-engineered it or bought the code. Kaspersky notes that APT actors rarely borrow from cybercrime toolkits.

The payload

The UEFI payload injects a malicious driver into the Windows kernel. It is signed with a now-revoked certificate belonging to Wenjiang District Mingyu Network Technology Service Studio and tries to cripple endpoint security. In an odd twist, some unauthorized actions run only if Kaspersky or Avast products are present — though the analysts found these routines ineffective.

The driver then drops espionage modules: a remote-access trojan using Google Drive, OneDrive, and Yandex.Disk for command-and-control, and a DLL called OxiDLLRunner, sideloaded by a legitimate googleupdate.exe to launch a Rust payload talking to archivetj[.]com.

The APT41 link rests on a June 2026 ESET report on the FishMonger subgroup and a shared "xdd" string. As the researchers put it, sophisticated adversaries need not reinvent the wheel to gain persistent, invisible control over high-value networks.

Source: The Hacker News