<![CDATA[BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations]]>Diplomatic organizations across Central Asia have been targeted by a sophisticated new UEFI bootkit tracked as BlackX, according to a technical report from Kaspersky. The campaign singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, and the activity is suspected to be orchestrated by the China-linked state-sponsored group known as APT41.

The bootkit's most notable capability is its ability to bypass Secure Boot on patched Windows systems that are missing the relevant revocations. In practice, this means fully updated machines can still be at risk if the necessary revocation updates were never applied, allowing BlackX to load before the operating system and operate beneath the visibility of typical security tooling.

Key points from the report:

  • Targeted sector: diplomatic organizations in Central Asia
  • Targeted countries: Tajikistan, Uzbekistan, and Turkmenistan
  • Timeframe: early 2026
  • Malware type: UEFI bootkit named BlackX
  • Notable behavior: bypasses Secure Boot on patched Windows systems lacking revocations
  • Suspected actor: APT41, a China-linked state-sponsored group

Because BlackX operates at the firmware and boot level, detection and removal are considerably harder than with conventional malware. Organizations should prioritize applying all outstanding revocation updates rather than relying solely on patch level, and should treat boot integrity monitoring as part of their defensive posture.

Source: info@thehackernews.com (The Hacker News)

Has your organization verified that Secure Boot revocation updates are actually deployed across your Windows fleet, or is patch compliance being assumed?

]]>https://xploitlk.com/topic/770/blackx-uefi-bootkit-bypasses-secure-boot-on-patched-windows-systems-missing-revocationsRSS for NodeTue, 27 Oct 2026 07:22:53 GMTSat, 24 Oct 2026 02:30:17 GMT60