BlackX bootkit exploits missing Secure Boot revocations on Windows
Kaspersky has identified a UEFI bootkit called BlackX in attacks on diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan during early 2026. The activity is suspected to be linked to the China-aligned APT41 group and targets Windows startup protections on devices where the operating-system update for CVE-2022-21894 has been installed but the related Secure Boot revocation has not been applied.
BlackX is assessed as an updated copy of BlackLotus, the bootkit associated with the Secure Boot bypass known as Baton Drop. CVE-2022-21894 carries a CVSS score of 4.4 and was patched by Microsoft, but the complete mitigation requires manual deployment of Secure Boot revocations. In particular, the Windows Production PCA 2011 certificate must be added to the UEFI Forbidden Signature Database, or DBX.
A patch alone does not block vulnerable boot binaries
Kaspersky said attackers are exploiting organizations that did not complete those manual remediation steps. The Windows Production PCA 2011 certificate expired on October 19, 2026, but vulnerable binaries can still load unless the certificate is explicitly blocklisted in the DBX. This leaves a path for the Baton Drop technique even where the relevant Windows patch is present.
The bootkit is a persistence and defense-evasion mechanism, rather than an initial-access tool. Microsoft has stated that deployment requires an attacker to have already obtained administrator privileges or physical access to the host. In the observed campaign, BlackX was installed after attackers breached victim networks by an unspecified method and gained administrative rights.
Installation and payload chain
The operators use an installer named inst.exe, an encrypted extensionless file named PVMDIJGKAX2, and an RC4 key supplied on the command line. Kaspersky observed the installer launched as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. It writes files to system and UEFI partitions, then exploits CVE-2022-21894 in a manner Kaspersky described as remarkably similar to BlackLotus.
BlackX installs Machine Owner Keys to load arbitrary EFI files and interfere with Secure Boot. Its UEFI component then injects a malicious driver into the Windows kernel. The driver was signed with a certificate assigned to Wenjiang District Mingyu Network Technology Service Studio; the issuer has since revoked that certificate.
The kernel driver attempts to disrupt endpoint security software in a pattern comparable to bring-your-own-vulnerable-driver activity. Some modification routines run only when Kaspersky or Avast products are detected, although Kaspersky found those routines ineffective. The driver also deploys espionage payloads: a remote-access trojan able to retrieve additional .NET components through Google Drive, OneDrive and Yandex.Disk, plus OxiDLLRunner, a DLL sideloaded by the legitimate googleupdate.exe program. OxiDLLRunner decrypts a Rust payload that contacts archivetj[.]com for further DLL plugins.
Links to APT41 and operational priorities
Kaspersky noted that BlackLotus source code has not entered the public domain, suggesting that BlackX operators either reverse-engineered it or obtained its source. The attribution assessment also draws on overlaps with FishMonger, an APT41-associated cluster tracked as Aquatic Panda and Earth Lusca. Kaspersky highlighted the shared xdd string between BlackX and a FishMonger kernel implant, as well as DLL sideloading, a technique frequently seen in operations attributed to Chinese-origin threat actors.
For security teams, the immediate implication is that Windows patch compliance must be checked alongside UEFI revocation status. Organizations should confirm that the Windows Production PCA 2011 certificate is blocklisted in the Secure Boot DBX, restrict and monitor administrator-level access, and investigate signs of unauthorized EFI, kernel-driver and boot-partition changes as part of incident response.