cyber.hendryadrian.com
Threat Research · thehackernews.com

BlackX Bootkit Targets Windows Systems Missing Secure Boot Revocations

· Original article ↗

Summary

Kaspersky reports that BlackX, a suspected BlackLotus copycat, targeted diplomatic organizations in Central Asia. It can exploit CVE-2022-21894 on patched Windows systems when required Secure Boot revocations have not been applied.

Key points

  • Kaspersky reported BlackX activity targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026; attribution to APT41 is suspected.
  • BlackX reportedly exploits CVE-2022-21894 (Baton Drop) on systems where the vulnerability patch is installed but the required Secure Boot certificate revocations have not been applied.
  • Attackers were observed deploying the bootkit after breaching networks and gaining administrator privileges; the initial access method is unspecified.
  • BlackX reportedly drops files to system and UEFI partitions, installs Machine Owner Keys to load EFI files, and delivers a kernel driver intended to interfere with endpoint security software.
  • Researchers say some driver modifications run only when Kaspersky or Avast products are present, but Kaspersky found those routines ineffective.
  • The driver also delivers a user-mode cyber-espionage payload. Researchers suggest BlackX may be a BlackLotus copycat; its source code has not been publicly released.
  • Possible APT41 links include the “xdd” string shared with a FishMonger kernel implant and DLL sideloading, but the article presents these as indications rather than conclusive attribution.

Article Details

Attack Vectors
  • Attackers reportedly breached victim networks by an unspecified method, then gained administrator privileges before deploying BlackX.
  • BlackX exploits CVE-2022-21894 when the related Secure Boot revocation has not been manually applied, allowing vulnerable binaries to load despite the patch being installed.
  • The installer is launched from the command line and uses an RC4 key to decrypt its contents; the installer then places files on system and UEFI partitions.
  • BlackX installs Machine Owner Keys to load arbitrary EFI files and interfere with Secure Boot, then delivers a UEFI payload that injects a malicious driver into the Windows kernel.
  • The driver attempts to tamper with endpoint security software and drops user-mode payloads for cyber espionage.
  • DLL sideloading was identified as a method used to deploy payloads.
Defensive Notes
  • Installing the latest update alone may not fully address the Secure Boot bypass; organizations should also apply Microsoft's manual Secure Boot revocation mitigations.
  • The article specifies adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX).
  • The certificate used to sign the malicious driver has been revoked by its issuer.

MITRE ATT&CK

T1140 · Deobfuscate/Decode Files or InformationThe BlackX installer uses an RC4 key to decrypt its contents.T1211 · Exploitation for StealthBlackX exploits CVE-2022-21894 to bypass Secure Boot protections when the required revocation has not been applied.T1542.003 · BootkitBlackX installs Machine Owner Keys and loads arbitrary EFI files to interfere with Secure Boot and persist through the boot process.T1553.002 · Code SigningThe malicious driver is signed with a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio; the issuer has since revoked the certificate.T1562.001 · Disable or Modify ToolsThe BlackX driver attempts to tamper with endpoint security software installed on infected machines.T1574.002 · DLL Side-LoadingDLL sideloading was identified as a method used to deploy payloads in the related activity.

CVE

CVE-2022-21894BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts. However,

People

Georgy KucherinNamed as a Kaspersky researcher who commented on the BlackX campaign and its likely development.Vasily BerdnikovNamed as a Kaspersky researcher who contributed to the report on BlackX.Vladimir NestorNamed as a Kaspersky researcher who contributed to the report on BlackX.

Threat Actors

Aquatic PandaThe article identifies Aquatic Panda as another tracking name for FishMonger.Earth LuscaThe article identifies Earth Lusca as another tracking name for FishMonger.FishMongerThe article says FishMonger is assessed to operate under the APT41 umbrella and is also tracked as Aquatic Panda and Earth Lusca.SPIRE CASTLEKaspersky suspects APT41 orchestrated the BlackX activity; the article says FishMonger operates under the APT41 umbrella.

Malware

BlackLotusNotably, BlackX is assessed to be an updated version of BlackLotus, a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESETBlackXDiplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.SprySOCKSstem from an ESET report in June 2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and

Vendors

MicrosoftThe primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.

Products

Microsoft WindowsThe primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.

Countries

HondurasFishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda andPakistanbackdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca, is assessed to beTaiwanuse of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca,TajikistanThe activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, KasperskyThailanduse of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca, isTurkmenistanThe activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, KasperskyUzbekistanThe activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky

Industries

Diplomatic organizationsDiplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.Government2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as

Related Articles