The BlackX bootkit is new UEFI malware that slips past Secure Boot on Windows machines that were fully patched. Kaspersky found it inside diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It links the campaign to APT41, a Chinese state-backed group, with medium confidence.
Sure, the flaw it abuses is old. Baton Drop (CVE-2022-21894) got a fix back in 2022. But here’s the thing: that fix never finished the job on its own.
Kaspersky published its full technical analysis on October 22. The attackers first grabbed admin rights inside the target networks. Then they dropped an installer and an encrypted package into a folder named after Intel. Sneaky touch. That package planted files on the hidden boot partition and used Baton Drop to install the attackers’ own trusted keys. After that, Secure Boot basically waves the malware through.
What does the BlackX bootkit actually do?
It loads before Windows does and injects a malicious driver into the kernel. That driver switches off the hooks security tools rely on and blinds Windows event tracing. So your antivirus sees a lot less than it thinks it does.
The hiding trick made me laugh a little, I’ll admit. If anyone tries to open the malware’s files, the driver hands back Windows Calculator instead. Petty. But effective.
From there it drops two payloads:
- A cloud-controlled remote access trojan. It takes orders through Google Drive, OneDrive and Yandex.Disk. To a firewall, that looks like someone syncing documents, which is exactly the point. Most cloud security practices don’t plan for malware hiding in plain sight like this.
- A Rust-based loader. A legit-looking googleupdate.exe sideloads a DLL, which unpacks the loader and pulls extra plugins from the attackers’ server.
Why APT41? Kaspersky spotted the username string “xdd” all over the payloads, matching a kernel implant ESET reported in June. The sideloading habit and obfuscation style also fit Chinese-speaking crews.
Is this just BlackLotus again?
Pretty much, with a new paint job. BlackLotus went on sale on a hacking forum for $5,000 in October 2022. ESET confirmed in March 2023 that it was real and abused this same flaw.
Kaspersky says the new exploit chain looks almost identical, but the driver is different. The BlackLotus source code never leaked. So either APT41 reverse-engineered it or bought it. Neither option is comforting, if you ask me.
State hackers rarely borrow from cybercrime crews. Then again, the LiteLLM supply chain attack just showed how fast attacker tooling spreads.
Why were fully patched PCs still vulnerable?
Because Microsoft’s fix needs a manual step that most admins never took. The patch can revoke the old “Windows Production PCA 2011” certificate that signed the vulnerable boot files. But that revocation stays off by default.
Microsoft held back because forcing it could break dual-boot setups. Its planned “Enforcement Phase” would flip it on automatically, but Kaspersky says that hasn’t happened yet.
The certificate also expired on October 19. You’d think that settles it. It doesn’t. Unless someone blocklists it, old boot files still load, which is how fully patched machines stayed exposed here.
This is the part that bugs me. We tell everyone to patch. They patched. And it still wasn’t enough.
What you should do
For most home users, the risk is low right now. BlackX hit a handful of diplomatic targets, and the attackers needed admin access first. Still, the gap is real.
- Install current Windows updates. The revocation tools only exist on updated systems.
- Turn on the Secure Boot revocations. Follow Microsoft’s guidance for CVE-2022-21894. On managed machines, set the registry flag under
HKLM\SYSTEM\CurrentControlSet\Control\Securebootand run the Secure-Boot-Update scheduled task. Test dual-boot machines first. - Lock down admin rights. BlackX only lands after attackers own an admin account. The habits behind good ransomware detection and protection apply here too.
- Watch cloud storage traffic. Unexpected Google Drive or OneDrive activity from a server deserves a second look.
What happens next?
It’s been a rough week for security news, between this and the Capcom data breach. I’ll be watching whether Microsoft finally pulls the trigger on automatic revocation.
Update: We’ll update this post if Microsoft enables automatic Secure Boot revocation or shares new guidance.
Sources: Kaspersky Securelist, BleepingComputer
