BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

BlackX, a UEFI bootkit linked to the China-linked APT41 group, has been observed targeting diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The malware bypasses Microsoft Windows Secure Boot on systems that have received the CVE-2022-21894 patch but have not applied the subsequent revocation updates. The attack demonstrates that a patched system can still be compromised if revocation controls are not enforced.

Attack Path and Preconditions

BlackX is an evolution of the earlier BlackLotus bootkit. Both rely on the same underlying vulnerability, CVE-2022-21894, also known as Baton Drop. The vulnerability allows a bootloader to load unsigned code before the operating system initializes. However, exploitation requires that the attacker already possess administrator privileges or physical access to the target machine. In the reported incidents, the attackers likely gained initial foothold through compromised credentials or device theft, then installed the bootkit to maintain persistence.

Persistence Mechanism

Once installed, BlackX resides in the UEFI firmware. It loads during the pre-OS phase, effectively bypassing all operating-system-level defenses, including endpoint protection solutions. Because the code runs before the OS loads, traditional antivirus or EDR tools cannot detect or block it. The bootkit also evades Windows Defender Advanced Threat Protection by leveraging the Secure Boot bypass, which is not mitigated by standard patching alone.

Evidence and Attribution

Kaspersky’s technical report identifies APT41 as the likely operator. The report cites similarities in code structure and deployment patterns to previous APT41 campaigns. Microsoft’s own guidance on BlackLotus confirms that the bootkit is a persistence and defense-evasion tool rather than an initial access vector.

Mitigation Steps

1. Apply the latest Windows updates that include the CVE-2022-21894 patch.
2. Implement Secure Boot revocation mitigations by following Microsoft’s manual revocation process. The key step is adding the Windows Production PCA 2011 certificate to the Secure Boot Forbidden List (DBX).
3. Verify UEFI firmware integrity on all affected devices. Use vendor tools or third-party utilities to check for unauthorized modifications.
4. Enforce least-privilege policies to reduce the likelihood of privileged access being compromised.
5. Monitor firmware logs for anomalous boot events. Windows Event IDs 6005 and 6006 can indicate firmware changes.

Log and Control Inspection

Defenders should examine the following logs:

• Windows Event Log: Look for Event ID 6005 (system startup) and 6006 (shutdown) for irregular patterns.
• UEFI firmware logs: Some vendors expose firmware logs via the BIOS interface; check for unexpected write operations.
• Security Information and Event Management (SIEM): Correlate firmware events with network activity to detect lateral movement.

Next Steps for Security Teams

• Conduct a firmware integrity audit across all Windows endpoints, prioritizing devices in high-risk regions.
• Deploy the Secure Boot revocation updates immediately; Microsoft provides step-by-step guidance in its revocation blog.
• Review privileged access controls and enforce MFA for administrative accounts.
• Consider deploying a firmware-level monitoring solution that can detect unauthorized changes to the UEFI.

Internal Reference

For a broader view of how CVE exploitation can impact firmware, see the Zero-Day Vulnerability & CVE Exploit Matrix.

Related coverage

• Microsoft Patch Tuesday 2026: 1,417 Vulnerabilities, Including Exploited Shell Bypass and Exchange RCE
• North Korea Targets Ukrainian Personnel with Reply-Bait Phishing

Explore more on this topic

• More uefi coverage