BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

In early 2026, a sophisticated UEFI bootkit named BlackX was used to bypass Secure Boot on patched Windows systems in Central Asia. The cyber espionage campaign, believed to be orchestrated by a China-linked state-sponsored group called APT41, targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. BlackX is an updated version of BlackLotus, a bootkit first seen in 2022 that exploits a patched Secure Boot vulnerability (CVE-2022-21894) to gain covert access to compromised devices.

However, successful exploitation requires admin privileges or physical access to the target host. Despite the patch, attackers are bypassing it by manually applying Microsoft Secure Boot revocation mitigations, such as adding the Windows Production PCA 2011 certificate to the Secure Boot UEFI Forbidden List. The BlackX bootkit installer, dropped after gaining admin privileges, drops additional files to system and UEFI partitions to exploit the vulnerability and install Machine Owner Keys, interfering with Secure Boot.

The malicious driver, signed with a revoked certificate, attempts to tamper with endpoint security software and drop user-mode payloads for cyber espionage. The use of DLL sideloading and the presence of the xdd string, similar to another backdoor linked to China-aligned threat actors, suggest a possible connection between BlackX and APT41.