New BlackX Bootkit Targets Diplomats and Slips Past Secure Boot on Systems Missing a Key Manual Step

Kaspersky has described a new UEFI bootkit called BlackX, used against diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The activity is suspected to be the work of APT41, a China-linked state-sponsored group. The malware aims to weaken Windows startup defences and third-party security tools while giving attackers long-term, hidden access to compromised devices.

BlackX is assessed to be an updated version of BlackLotus, a bootkit first advertised on cybercrime forums in late 2022 and confirmed by ESET in March 2023. BlackLotus abused a Secure Boot bypass flaw, CVE-2022-21894 (also called Baton Drop), to load malicious code before the operating system starts. Microsoft has noted that this kind of tool is about persistence and evasion, not initial access. An attacker needs administrator privileges or physical access to the device first.

The key issue is that installing the patch alone does not fully fix the problem. Organisations also need to apply Microsoft's Secure Boot revocation steps manually, including adding the "Windows Production PCA 2011" certificate to the Secure Boot Forbidden List (DBX). Kaspersky found attackers are exploiting the fact that many organisations have skipped this step, so Baton Drop still works on patched systems. Researchers also noted that the certificate expired on October 19, 2026, but that does not stop vulnerable binaries from loading unless the certificate is blocklisted.