Threat feed

BlackX UEFI bootkit

BlackX UEFI bootkit: APT41-attributed (medium confidence) revival of BlackLotus defeats Secure Boot on fully patched Windows

Posted · Updated · Spectrum Delta Research Team

Summary

Kaspersky GReAT (Oct 22, A/3) documents BlackX, a UEFI bootkit used in an early-2026 APT campaign that infected machines at diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan, attributed to APT41 with medium confidence. It re-implements the BlackLotus crimeware bootkit's Baton Drop chain (CVE-2022-21894) to install custom Machine Owner Keys on fully patched hosts — possible because Microsoft's fix requires a manual Secure Boot certificate revocation step the targeted hosts had not activated — followed by a kernel driver that impairs security tooling and espionage payloads.

Breakdown

Adversary

APT41

Procedures (3)

  1. RC4-encrypted installer enrolls MOKs via Baton Drop

    Pre-OS boot: encrypted installer chain and Baton Drop MOK enrollment

    • T1542.003Pre-OS Boot: Bootkit

    Logs

    • Windows EDR / Sysmon process+file · inst.exe with key argument; EFI partition writes; googleupdate.exe sideload pair

    Detectors

    No known detector

Click to expand remaining (2) procedures

  1. googleupdate.exe sideloads OLLVM-obfuscated OxiDLLRunner

    DLL sideloading: googleupdate.exe loads OxiDLLRunner

    • T1574.002

    Logs

    • Windows EDR / Sysmon process+file · inst.exe with key argument; EFI partition writes; googleupdate.exe sideload pair

    Detectors

    No known detector

  2. Cloud-storage dead-drop C2 with file-suffix protocol

    Legitimate web service: cloud-storage dead-drop C2

    • T1102.002Web Service: Bidirectional Communication

    Logs

    • Network / DNS / proxy · Cloud-storage API egress (Drive, OneDrive, Yandex); www.archivetj.com

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Securelist (https://securelist.com/uefi-bootkit-blackx/121539/), A/3) — installer command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1 (extensionless RC4-encrypted package PVMDIJGKAX2, RC4 key Q46F6MDLI3RX2KV1 on the command line); sideloading pair googleupdate.exe (original filename jcef_helper.exe, MD5 AF8A983B9ADA07EAE1259BF2953ABD40) with OxiDLLRunner DLL decrypting v8_context_snapshot.bin; Rust payload C2 www[.]archivetj[.]com expecting DLLs exporting create_plugin; driver-signing organization Wenjiang District Mingyu Network Technology Service Studio (温江区明宇网络技术服务工作室), certificate serial 0bcdf5e0da32d68900b8b7638459d072 (revoked by its issuer at time of writing); identifier xdd in bootkit payloads; vulnerability CVE-2022-21894 (Baton Drop); revocation gap markers: scheduled task Secure-Boot-Update, registry under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot, unrevoked Windows Production PCA 2011 certificate (expired Oct 19 2026 — expiry alone does not block loading). Assessed 2026-10-24, hunt-only — the installer artifacts, C2 domain and certificate serial are durable named-tool indicators; the durable hunt value is the behavioral chain (encrypted installer stage, EFI-partition writes, security-callback tampering, sideloaded pair, cloud-storage tasking).

Detailed

Installer: C:\ProgramData\Intel\inst.exe with arguments PVMDIJGKAX2 (extensionless RC4-encrypted package) and Q46F6MDLI3RX2KV1 (RC4 key). Sideload chain: googleupdate.exe, original filename jcef_helper.exe, MD5 AF8A983B9ADA07EAE1259BF2953ABD40; OxiDLLRunner (OLLVM-obfuscated DLL); decrypted file v8_context_snapshot.bin (shellcode + Rust PE). Rust payload C2: www[.]archivetj[.]com; received plugins must export create_plugin. Driver signing: Wenjiang District Mingyu Network Technology Service Studio (温江区明宇网络技术服务工作室), certificate serial 0bcdf5e0da32d68900b8b7638459d072, revoked by issuer at report time. Vulnerability: CVE-2022-21894 (Baton Drop). Revocation-gap markers: HKLM\SYSTEM\CurrentControlSet\Control\Secureboot registry flag; scheduled task Secure-Boot-Update; Windows Production PCA 2011 certificate (expired 2026-10-19, unrevoked). Attribution marker: identifier xdd in bootkit payloads (matches ESET FishMonger PDB path, June 2026). Campaign: early 2026, diplomatic agencies Tajikistan/Uzbekistan/Turkmenistan. All from the primary (Securelist (https://securelist.com/uefi-bootkit-blackx/121539/), A/3, Oct 22 2026), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of BlackX UEFI bootkit? Bring them to the community.

Discuss in the Tradecraft Slack