CVE-2022-21894 — a patched Secure Boot bypass known as Baton Drop — can still be leveraged by attackers on systems that have not applied Microsoft's manual Secure Boot revocation mitigations, Kaspersky's analysis shows.
BlackX: a UEFI bootkit tailored to persist on patched Windows hosts
Kaspersky published a technical report this week detailing a new Unified Extensible Firmware Interface (UEFI) bootkit it calls BlackX, which was used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The company assesses BlackX is an updated copycat of BlackLotus, the notorious bootkit first advertised on cybercrime forums in late 2022 and confirmed by ESET in March 2023.
BlackX's purpose mirrors BlackLotus: undermine Windows startup defenses and third‑party security products to maintain long‑term, covert access to infected devices. The UEFI payload injected a signed kernel driver into Windows and installed Machine Owner Keys (MOK) so arbitrary EFI files could be loaded at boot, thereby interfering with Secure Boot.
How operators install and run BlackX
Kaspersky observed attackers deploying BlackX after gaining administrator privileges on compromised hosts. The actor drops two primary artifacts: an installer executable named inst.exe and an encrypted, extensionless file named PVMDIJGKAX2 that contains installation resources and strings.
The installer is launched via command line in the form: C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1, where the final token is an RC4 key used to decrypt the payload. The binary then writes files to both the system and UEFI partitions and proceeds to exploit CVE‑2022‑21894 in a manner Kaspersky describes as "remarkably similar" to BlackLotus.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSigned driver, user‑mode backdoors, and cloud‑based C2
The UEFI payload drops a kernel driver signed with a certificate issued to "Wenjiang District Mingyu Network Technology Service Studio" — a certificate that Kaspersky says has since been revoked by the issuer. The driver attempts to tamper with endpoint security software; Kaspersky found some unauthorized routines that only run when Kaspersky or Avast products are present, but judged those routines ineffective.
In addition to kernel tampering, BlackX delivers user‑mode espionage payloads. Kaspersky observed two modules: a remote access trojan capable of loading further .NET payloads and using Google Drive, OneDrive, and Yandex.Disk for command‑and‑control; and a malicious DLL named OxiDLLRunner that is sideloaded by a delivered legitimate googleupdate.exe. OxiDLLRunner decrypts and launches a Rust payload that contacts archivetj[.]com to fetch and run additional DLL plugins.
Connections to APT41, FishMonger, and reuse of crimeware techniques
Kaspersky links BlackX to activity under the APT41 umbrella, citing an ESET report from June 2026 that documented FishMonger’s use of a Windows backdoor called SprySOCKS against governments in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. ESET also reported "limited indications" that some SprySOCKS versions may include a UEFI component likely exploiting CVE‑2023‑24932.
Kaspersky highlights two overlaps that point toward shared tooling or authorship: the appearance of the string "xdd" in both BlackX and a FishMonger kernel implant, and the use of DLL sideloading to deploy payloads — a pattern the report notes is "extremely common among threat actors of Chinese origin." The report also emphasizes that BlackX appears to have been developed without the original BlackLotus source code entering the public domain, meaning the actors either reverse‑engineered BlackLotus or obtained its code from another party. "Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors," Kaspersky wrote.
What this means for technologists and for diplomatic organizations
For technologists and security teams: Kaspersky’s findings underline that installing the Windows update alone does not complete mitigation for Baton Drop (CVE‑2022‑21894). Microsoft's published mitigations require manual steps — for example, adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX) — to block the vulnerable binaries. Kaspersky warned that attackers were capitalizing on organizations not carrying out those manual steps.
For diplomatic missions and the affected enterprises Kaspersky named — diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan — the observed tradecraft is notable for persistence and stealth. The chain combines firmware‑level boot persistence, a signed kernel driver that attempts to disable security controls, cloud‑based C2 channels that blend with enterprise workflows, and DLL sideloading to execute additional plugins. Kaspersky’s researchers flagged the operational choice to reuse a commercial crimeware concept as a way to "bypass procedures intended to protect the Windows boot processes."
Conclusion
BlackX illustrates a hybrid calculus: attackers adapted a known bootkit approach to work around incomplete deployment of Windows Secure Boot revocation mitigations. As Kaspersky put it, "By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes." The practical takeaway in Kaspersky's analysis is narrow and stark — unless organizations apply the manual revocation and Forbidden List (DBX) steps Microsoft documented, a patched system may nonetheless be vulnerable to UEFI bootkits that install persistent, hard‑to‑erase implants.
https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html
