Kaspersky has documented BlackX, a UEFI bootkit that bypasses Secure Boot on fully patched Windows machines that are missing manual revocations. Kaspersky links the campaign to APT41 with moderate confidence. The Hacker News and BleepingComputer both covered the report this week.
Kaspersky says the bootkit was used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. It is a BlackLotus copycat. It abuses CVE-2022-21894, known as Baton Drop, by booting vulnerable Microsoft-signed boot components. That flaw carries a CVSS score of 4.4. Installing the January 2022 patch does not close the hole on its own.
Why it matters. A bootkit loads before the operating system and before most endpoint tooling. It can blind security products and survive reinstalls of the OS. Kaspersky notes that APT actors rarely borrow code from cybercrime actors. BlackLotus source code was never public, so the BlackX authors either reverse-engineered it or bought it.
Technical detail, per Kaspersky's report as summarized by The Hacker News:
Exploitation needs administrator privileges or physical access. The attackers breach the network first.
The installer, inst.exe, is dropped into C:\ProgramData\Intel\ with an encrypted payload file named PVMDIJGKAX2. It is run with an RC4 key on the command line.
It writes files to the system and EFI partitions and enrolls Machine Owner Keys so it can load arbitrary EFI files.
The UEFI payload injects a malicious kernel driver. The driver was signed with a certificate that its issuer later revoked.
The driver tampers with endpoint security software. Some routines run only when Kaspersky or Avast products are present. Kaspersky found those routines ineffective.
A user-mode remote access trojan loads .NET payloads and uses Google Drive, OneDrive and Yandex.Disk for command and control. A DLL named OxiDLLRunner is sideloaded by a legitimate googleupdate.exe. It launches a Rust payload that contacts archivetj[.]com for further plugins.
Attribution rests on an ESET report about FishMonger, also tracked as Aquatic Panda and Earth Lusca. ESET saw limited indications of a UEFI bootkit component tied to CVE-2023-24932. A shared "xdd" string appears in both BlackX and FishMonger's kernel implant. DLL sideloading is a further, but common, pattern among China-origin actors. Treat this as an assessment, not a confirmed attribution.
Mitigation. Patching is not enough. Apply Microsoft's Secure Boot revocations manually. A key step is adding the Windows Production PCA 2011 certificate to the DBX, the Secure Boot forbidden list. The certificate expired on October 19, 2026, but expiry alone does not stop the vulnerable binaries from loading. They only stop loading once the certificate is blocklisted. Also revoke the affected Windows Boot Manager versions to close the CVE-2023-24932 downgrade path. Test the DBX change on a pilot group first, because revocations can break recovery media and older boot images.
Detection ideas. Hunt for inst.exe or unexpected files under C:\ProgramData\Intel\, for unexpected Machine Owner Key enrollments, and for googleupdate.exe loading side-by-side DLLs. Watch for traffic to archivetj[.]com and for unusual API traffic to Google Drive, OneDrive and Yandex.Disk from servers. Kaspersky's Securelist report carries the full hashes and indicators.
