BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Kaspersky has detailed a new UEFI bootkit named BlackX used in targeted intrusions against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, with suspected ties to the China-linked APT41 cluster. The malware is believed to be a reworked clone of the infamous BlackLotus bootkit, exploiting the same Secure Boot bypass flaw, CVE-2022-21894 (Baton Drop), which still works on devices that installed Microsoft's official patch but never performed the additional manual step of adding the old boot manager certificate to the Secure Boot Forbidden List (DBX). After gaining admin-level access, attackers drop an installer and encrypted payload that plant a malicious signed driver into the Windows kernel, attempting to disable security tools from vendors including Kaspersky and Avast, and then deploy espionage tools such as a .NET-capable RAT abusing cloud storage services for C2 and a DLL loader called OxiDLLRunner. Researchers note overlaps with APT41-linked FishMonger activity using the SprySOCKS backdoor, and urge organizations to manually apply the DBX revocation rather than relying solely on the patch.