BlackX Bootkit Bypasses Secure Boot on Patched Windows 11

Kaspersky and ESET researchers disclosed BlackX, a UEFI bootkit used in an early-2026 espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. The campaign is attributed to APT41, also tracked as Brass Typhoon, Wicked Panda, and Barium, at medium confidence.

BlackX exploits CVE-2022-21894, the “Baton Drop” Secure Boot bypass Microsoft patched in January 2022. The patch shipped years ago. The gap: it includes certificate revocations that require explicit manual activation; a fully updated system that skipped that step is still exposed. Those certificates had a hard expiry of October 19, 2026, so the window for attackers to exploit this was available until very recently on any system where revocations weren’t applied.

Once BlackX loads, it enrolls custom Machine Owner Keys (MOKs) and arbitrary EFI files, then drops a kernel driver signed with a revoked certificate from “Wenjiang District Mingyu Network Technology Service Studio.” The driver kills security processes and registry callbacks, tampers with Event Tracing for Windows (ETW), and specifically targets Kaspersky and Avast. When security tooling accesses its files, it launches Calculator to mask the activity.

Command-and-control runs through cloud storage: Google Drive, OneDrive, and Yandex.Disk. The payload is delivered via OxiDLLRunner and includes a remote access trojan. Using cloud C2 blends malicious traffic with normal enterprise activity and makes egress filtering harder.

This is APT41’s third publicly documented campaign against Central Asian targets this year and follows a broader pattern of the group using supply-chain and firmware-level persistence to stay ahead of standard endpoint defenses. See also our coverage of Arista VeloCloud CVE-2026-114625, another APT-linked campaign from the same week, and CISA’s KEV additions for Collabora and VeloCloud. For earlier UEFI Secure Boot bypass research from ESET, see the July 2026 shim vulnerability coverage.

What to do

Patching CVE-2022-21894 is necessary but not the complete fix. The actual mitigation requires these steps:

• Apply Microsoft’s Secure Boot certificate revocations explicitly; this is separate from standard Windows Update. Verify revocation status on each system rather than assuming patch deployment covers it.
• Audit EFI partitions for unexpected MOK enrollments or unfamiliar EFI binaries.
• In environments where Google Drive, OneDrive, or Yandex.Disk aren’t used for business purposes, flag outbound connections to those services as a potential C2 detection signal.

For organizations in the diplomatic and government sectors, UEFI-layer persistence is increasingly the technique to watch. Patch compliance reporting won’t catch a system where the patch installed but the revocation didn’t apply.