The discovery of the BlackX UEFI bootkit has highlighted a persistent “revocation gap” in modern system security, where vulnerabilities patched at the software level remain exploitable for years due to the complexities of Secure Boot management. Reported by Kaspersky’s Global Research and Analysis Team (GReAT) on October 22, 2026, the bootkit successfully bypasses hardware-rooted security measures by leveraging a four-year-old flaw known as “Baton Drop.”
The vulnerability, tracked as CVE-2022-21894, allows attackers to subvert the Secure Boot process during the initial stages of a computer’s startup. Although Microsoft released software patches for this flaw in early 2022, the underlying issue persists because the cryptographic signatures of the vulnerable bootloaders were not universally revoked. This creates a “fully patched but vulnerable” paradox: a system may have the latest Windows updates installed, but if the Secure Boot Forbidden Signature Database (DBX) has not been manually updated to block the specific vulnerable binaries, an attacker can still use them to gain control before the operating system even begins to load.
The Mechanics of BlackX and the Revocation Gap
BlackX is structurally similar to the BlackLotus bootkit that emerged in 2023, leading researchers to believe it is a reverse-engineered copycat or a derivative tool. Like its predecessor, BlackX is designed to achieve persistence at the highest level of system privilege, making it nearly impossible to detect or remove using standard antivirus software once it has established itself within the EFI (Extensible Firmware Interface) partition.
A critical factor in the current threat landscape is the status of the “Windows Production PCA 2011” certificate. This certificate, which signs many of the vulnerable binaries used in these attacks, expired on October 19, 2026. However, the expiration of a certificate does not automatically prevent a computer from loading a signed binary. Unless the specific hashes of the compromised bootloaders are added to the UEFI DBX, the firmware will continue to trust and execute the malicious loader, allowing the BlackX campaign to continue unabated.
Closing this loophole requires administrators to take manual steps to enforce Secure Boot revocations. Standard Windows Updates often avoid automated DBX updates because a failure in the process or an incompatible hardware configuration can result in “bricked” systems that refuse to boot entirely. This risk has left many enterprise and diplomatic environments exposed to UEFI-level threats long after the initial security fixes were announced.
Targeting and Post-Exploitation Activity
Kaspersky researchers have attributed the campaign to the Chinese state-sponsored threat group APT41 with medium confidence, citing similarities in tactics and infrastructure used in previous operations.
Once the bootkit successfully bypasses Secure Boot, it facilitates the deployment of a cloud-storage-based Remote Access Trojan (RAT). This secondary malware utilizes legitimate services—including Google Drive and OneDrive—for its command-and-control (C2) communications. By masking its traffic as routine interactions with popular cloud providers, the RAT can effectively bypass network-level security filters and exfiltrate sensitive data from high-value targets.
The persistence of BlackX underscores the difficulty of maintaining a secure boot chain across diverse hardware environments. As long as vulnerable, signed binaries remain “trusted” by system firmware, UEFI bootkits will continue to serve as a tier-one threat for state-sponsored actors seeking long-term, stealthy access to critical networks.
