BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Summary: Kaspersky reported that BlackX, a UEFI bootkit assessed as an updated copy of BlackLotus, targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026 and is suspected to be run by the China-linked group APT41. BlackX exploits the patched Baton Drop vulnerability CVE-2022-21894 to install Machine Owner Keys and load arbitrary EFI files, and it works even on patched systems because organizations have not manually added the 'Windows Production PCA 2011' certificate to the Secure Boot UEFI Forbidden List (DBX).
What's compelling: The fix for CVE-2022-21894 only holds if someone manually blocklists the expired certificate, and Kaspersky's finding is that few organizations did - which is the gap APT41 is exploiting to keep persistent, hidden control over diplomatic networks.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2022-21894
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026