CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

BlackX

malware · malware:blackx-uefi-bootkit single-source

UEFI bootkit similar to BlackLotus that exploits Baton Drop (CVE-2022-21894) to enrol attacker Machine Owner Keys and load a kernel driver that disables security-product callbacks and ETW providers; Kaspersky GReAT found it in early 2026 on networks of diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, on fully patched machines because Microsoft's certificate revocation is not enabled by default, and attributes it to APT41 with medium confidence (Kaspersky GReAT, 2026-10-22).

Aliases: BlackX UEFI bootkit

Coverage
1
first 2026-10-23 → last 2026-10-23
Latest activity
2026-10-23
Kaspersky: a UEFI bootkit ran on fully patched Windows because Microsoft's Secure Boot revocation is off by…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
2
2 hosts

Defender insights

What each entry about BlackX tells a defender to do, newest first.

2026-10-23NOTABLEexploitedKaspersky: a UEFI bootkit ran on fully patched Windows because Microsoft's Secure Boot revocation is off by default

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

affects

Story timeline

  1. 2026-10-23BlackX: Kaspersky finds a BlackLotus-style UEFI bootkit on fully patched Windows machines of Central Asian diplomatic bodies, because the Baton Drop fix does not revoke the old boot-manager certificate until an administrator triggers it
    active-threatsKaspersky: a UEFI bootkit ran on fully patched Windows because Microsoft's Secure Boot revocation is off by default

Hunting pivots

CVEs (exploited first)
CVE-2022-21894CVE-2023-24932
Affected products
Microsoft Windows
Tags
actively-exploitedchina-nexusespionagenation-state
ATT&CK techniques (8 across 5 tactics)

8 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionHijack Execution Flow: DLL
  • PersistencePre-OS Boot: Bootkit
  • StealthRootkit · Obfuscated Files or Information · Pre-OS Boot: Bootkit · Hijack Execution Flow: DLL
  • Defense ImpairmentSubvert Trust Controls: Code Signing Policy Modification · Disable or Modify Tools · Exploitation for Defense Impairment
  • Command and ControlWeb Service: Bidirectional Communication

Execution TA0002

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

Persistence TA0003

T1542.003Pre-OS Boot: Bootkit×1

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

Stealth TA0005

T1014Rootkit×1

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

T1542.003Pre-OS Boot: Bootkit×1

Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

Defense Impairment TA0112

T1553.006Subvert Trust Controls: Code Signing Policy Modification×1

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

T1687Exploitation for Defense Impairment×1

Adversaries may exploit vulnerabilities in security software, infrastructure, or defensive components to degrade, disable, or otherwise continue to impair their ability to prevent, detect, or respond to malicious activity.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

Command and Control TA0011

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-10-23/blackx-uefi-bootkit-baton-drop-revocation-default-off · ATT&CK page ↗

Entries about BlackX (1)

2026-10-23 · view entry permalink →

NOTABLECVE-2022-21894 +1exploitedNATOB2

BlackX: Kaspersky finds a BlackLotus-style UEFI bootkit on fully patched Windows machines of Central Asian diplomatic bodies, because the Baton Drop fix does not revoke the old boot-manager certificate until an administrator triggers it

Kaspersky GReAT reports that in early 2026 it found BlackX, a UEFI bootkit similar to BlackLotus, used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan after the attackers held administrator privileges: an installer takes an RC4-encrypted package and its key as command-line arguments and drops files to the system and UEFI partitions that exploit Baton Drop (CVE-2022-21894) to enrol attacker-controlled Machine Owner Keys, so arbitrary EFI files load despite Secure Boot (Kaspersky GReAT, 2026-10-22). Kaspersky ties the exploitation to Baton Drop alone; CVE-2023-24932, the flaw Microsoft's revocation guidance is titled for, appears in its post only as the one a UEFI component in ESET's FishMonger report might exploit (Kaspersky GReAT, 2026-10-22). The bootkit injects a kernel driver, signed with a certificate its issuer has since revoked, that disables process, thread and registry callbacks and ETW providers of security products; the user-mode payloads were a RAT that uses Google Drive, OneDrive or Yandex.Disk for command and control and a sideloaded loader (Kaspersky GReAT, 2026-10-22).

The targeted machines were fully patched. Microsoft's fix revokes the Windows Production PCA 2011 certificate only when an administrator sets a Secure Boot registry flag and runs the Secure-Boot-Update scheduled task (Kaspersky GReAT, 2026-10-22); Microsoft's own article says the mitigations in the updates of 2024-07-09 and later are not enabled by default and the Enforcement Phase date is still to be announced (Microsoft Support, 2026-09-30), and Kaspersky says that phase has not been implemented and the certificate's expiry on 2026-10-19 does not stop the vulnerable binaries loading unless it is on the forbidden list (Kaspersky GReAT, 2026-10-22). Kaspersky attributes the campaign to APT41 with medium confidence, resting on the identifier "xdd" shared with a kernel implant in ESET's June 2026 FishMonger report, DLL sideloading and OLLVM (Kaspersky GReAT, 2026-10-22).

the targeted machines were fully patched

However, this revocation does not happen automatically upon patch installation

we have attributed this attack to the APT41 threat actor with medium confidence

Kaspersky GReAT (Securelist) 2026-10-22

However, these mitigations are not enabled by default.

Microsoft Support (KB5025885) 2026-09-30

Builds on: FishMonger (I-SOON) ports its SprySOCKS backdoor to Windows with a kernel-driver rootkit · ESET details 11 Microsoft-signed pre-0.9 UEFI shims that bypass Secure Boot on any machine…

threat23 Oct 03:39Zsingle-sourceOpen finding →
Sources: Kaspersky GReAT (Securelist) · Microsoft Support (KB5025885)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • securelist.com1 (50%)
  • support.microsoft.com1 (50%)
All cited sources (2)