BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
-
Diplomatic organizations across Central Asia have been targeted by a sophisticated new UEFI bootkit tracked as BlackX, according to a technical report from Kaspersky. The campaign singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, and the activity is suspected to be orchestrated by the China-linked state-sponsored group known as APT41.
The bootkit's most notable capability is its ability to bypass Secure Boot on patched Windows systems that are missing the relevant revocations. In practice, this means fully updated machines can still be at risk if the necessary revocation updates were never applied, allowing BlackX to load before the operating system and operate beneath the visibility of typical security tooling.
Key points from the report:
- Targeted sector: diplomatic organizations in Central Asia
- Targeted countries: Tajikistan, Uzbekistan, and Turkmenistan
- Timeframe: early 2026
- Malware type: UEFI bootkit named BlackX
- Notable behavior: bypasses Secure Boot on patched Windows systems lacking revocations
- Suspected actor: APT41, a China-linked state-sponsored group
Because BlackX operates at the firmware and boot level, detection and removal are considerably harder than with conventional malware. Organizations should prioritize applying all outstanding revocation updates rather than relying solely on patch level, and should treat boot integrity monitoring as part of their defensive posture.
Source: [email protected] (The Hacker News)
Has your organization verified that Secure Boot revocation updates are actually deployed across your Windows fleet, or is patch compliance being assumed?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login