Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot

Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan.

Researchers attribute the operation to APT41 with medium confidence.

BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022.

ESET confirmed its capabilities in March 2023, demonstrating exploitation of Baton Drop, tracked as CVE-2022-21894.

Although Microsoft patched that vulnerability in January 2022, attackers could still introduce older, legitimately signed boot components that had not been revoked.

Attackers deploy BlackX after compromising networks and obtaining administrator privileges. Its installer, inst.exe, operates alongside an RC4-encrypted, extensionless container named PVMDIJGKAX2.

The observed execution uses Q46F6MDLI3RX2KV1 as the decryption key. Keeping installation components outside the executable complicates recovery and analysis when responders obtain only the installer.

The installation chain places components on Windows and EFI partitions, then exploits Baton Drop to enroll attacker-controlled Machine Owner Keys.

These keys enable subsequent loading of malicious EFI applications through the manipulated boot chain.

Kaspersky discovered the campaign in early 2026; it exploits a Windows Secure Boot protection gap that leaves even fully patched systems exposed when administrators have not explicitly activated bootloader revocations.

APT41-Linked Bootkit Attack

Kaspersky observed substantial similarities to BlackLotus, alongside implementation differences, suggesting reverse engineering or access to its source code rather than establishing a confirmed development relationship.

BlackX subsequently injects a malicious driver into the Windows kernel. Unlike BlackLotus’s driver, this component was signed using a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio. The issuer has since revoked that certificate.

The driver turns off security-related process, thread, and registry callbacks and interferes with Event Tracing for Windows providers. It also protects bootkit files by redirecting attempts to open them toward calc.exe.

However, Kaspersky reported that product-specific tampering routines failed to interfere with its security software during testing.

Researchers identified two user-mode payloads. One is a remote-access trojan that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control communications.

File suffixes identify instructions and results, supporting additional .NET execution, file transfers, and initial system-information reporting.

The second, OxiDLLRunner, uses OLLVM obfuscation and DLL sideloading access through a legitimate executable renamed googleupdate.exe.

It decrypts v8_context_snapshot.bin to expose shellcode and a Rust payload communicating with www[.]archivetj[.]com. Downloaded DLL plugins export create_plugin and execute in separate threads.

Attribution partly rests on the identifier “xdd,” also present in a driver development path documented in ESET’s June 2026 FishMonger research.

ESET reported limited indications of an unspecified bootkit, possibly exploiting CVE-2023-24932. Kaspersky assesses that BlackX could explain those observations, but the connection remains inferential.

The central weakness is incomplete revocation, not simply missing patches. Microsoft’s mitigation requires updating Secure Boot trust databases and explicitly revoking Windows Production PCA 2011 through the forbidden-signature database, or DBX. Microsoft’s guidance states these mitigations are not enabled by default.

Although that certificate expired on October 19, 2026, Kaspersky says expiration alone does not block vulnerable binaries.

Administrators should validate revocation status and follow Microsoft’s staged deployment guidance, including updating recovery media and testing boot compatibility.

Applying revocations without first preparing trusted replacement components can prevent systems from booting, making controlled rollout and verification essential.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.