BlackX UEFI Bootkit Bypasses Secure Boot on Windows Systems
A new UEFI bootkit named BlackX has been discovered targeting diplomatic organizations in Central Asia. It bypasses Secure Boot protections on fully patched Windows systems by exploiting missing certificate revocations.
TL;DR
- BlackX is a new UEFI bootkit targeting diplomatic entities in Central Asia.
- It bypasses Secure Boot even on up-to-date Windows systems.
- The attack exploits unrevoked certificates to maintain persistence.
- Suspected China-linked APT41 group is believed to be behind the campaign.
- Organizations should audit firmware and certificate trust stores immediately.
Cybersecurity researchers have uncovered a new and sophisticated UEFI bootkit, dubbed BlackX, that successfully bypasses Secure Boot protections on fully updated Windows systems. The malware specifically targeted diplomatic institutions in Tajikistan, Uzbekistan, and Turkmenistan earlier in 2026.
This stealthy bootkit leverages a critical gap in firmware security—systems that failed to revoke compromised certificates—allowing attackers to maintain low-level persistence across reboots and OS reinstalls. Kaspersky researchers attribute the campaign to APT41, a China-linked advanced persistent threat group known for espionage operations.
Technical Details of BlackX Infection
- BlackX modifies UEFI firmware to execute malicious code during system startup.
- It abuses unrevoked certificates to pass Secure Boot validation checks.
- The bootkit achieves kernel-level persistence before the operating system loads.
- Victims remain compromised even after reimaging their hard drives.
- Traditional antivirus tools cannot detect the infection at runtime.
Defensive Recommendations
- Audit all UEFI firmware images for unauthorized modifications.
- Ensure revoked certificates are properly removed from trusted certificate stores.
- Deploy hardware-based attestation tools to verify boot integrity.
- Monitor network traffic for unusual outbound connections from legacy protocols.
- Implement endpoint detection and response solutions with firmware visibility.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.