Ethical Hacking News
A sophisticated UEFI bootkit called BlackX has been discovered, which has the ability to bypass Secure Boot on patched Windows systems. The malware is believed to be orchestrated by a China-linked state-sponsored hacking group known as APT41, with the primary objective being to undermine Microsoft Windows startup defenses and maintain long-term, covert access to compromised devices. The bootkit exploits a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894, allowing it to load malicious code before the operating system starts. The attack is an example of the evolving threat landscape in the world of cybersecurity.
BlackX, a sophisticated UEFI bootkit, has been discovered with the ability to bypass Secure Boot on patched Windows systems.Believed to be orchestrated by China-linked state-sponsored hacking group APT41.Primary objective: undermine Microsoft Windows startup defenses and maintain long-term, covert access to compromised devices.Exploits CVE-2022-21894 (CVSS score: 4.4) vulnerability to load malicious code before the operating system starts.Not a first-stage payload or initial access vector, but a persistence and defense evasion mechanism.Attackers deploy BlackX after breaching victim networks, using administrator privileges or physical access.Installs Machine Owner Keys (MOK) to load arbitrary EFI files and interfere with Secure Boot.Source code of BlackLotus, another bootkit, has not entered the public domain, suggesting APT41 reverse-engineered or purchased the code.
The world of cybersecurity is a complex and ever-evolving landscape, with new threats emerging daily. In recent times, a sophisticated UEFI bootkit called BlackX has been discovered, which has the ability to bypass Secure Boot on patched Windows systems. According to a recent report by Kaspersky, a Russian cybersecurity company, this malware is believed to be orchestrated by a China-linked state-sponsored hacking group known as APT41.
The primary objective behind deploying the BlackX malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices. To achieve this, BlackX exploits a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop. This vulnerability allows BlackX to load malicious code before the operating system starts, making it a persistence and defense evasion mechanism for the threat actor.
It is worth noting that a threat actor's use of this bootkit is primarily a persistence and defense evasion mechanism, as stated by Microsoft. The use of this bootkit does not constitute a first-stage payload or an initial access vector, and it can only be deployed to a device to which a threat actor has already gained either privileged access or physical access.
Attackers have been observed deploying BlackX after breaching victim networks through an unspecified method and gaining administrator privileges. To install the bootkit, the threat actor drops the following files: inst.exe, an installer executable, PVMDIJGKAX2, an encrypted extensionless file containing files and strings required for the installation. The installer is then launched via the command line as "C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1," where "Q46F6MDLI3RX2KV1" is the RC4 key used for decryption.
The binary then drops additional files to both system and UEFI partitions to exploit CVE-2022-21894 in a manner that's "remarkably similar" to the one used in BlackLotus. The end goal remains the same: install Machine Owner Keys (MOK) to load arbitrary EFI files on the infected hosts and interfere with Secure Boot.
Interestingly, the source code of BlackLotus has never entered the public domain, indicating that the threat actors behind BlackX either reverse-engineered the original bootkit or purchased its source code from another party. This is an interesting observation, as it is rarely seen for APT actors to borrow ideas or code from cybercrime actors.
The UEFI payload delivered following the exploitation of the vulnerability is engineered to inject a malicious driver into the Windows kernel. The driver has been signed with a certificate belonging to a company named Wenjiang District Mingyu Network Technology Service Studio. The certificate has since been revoked by the issuer.
In a similar manner to the bring your own vulnerable driver (BYOVD) attack, the driver attempts to tamper with the functioning of endpoint security software installed on the machine. In an interesting twist, some of the unauthorized modifications are allowed to run only if security programs associated with Kaspersky or Avast are present. However, Kaspersky's analysis has found these routines to be ineffective.
Furthermore, BlackX's connections to APT41 stem from an ESET report in June 2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca, is assessed to be operating under the APT41 umbrella.
In addition, the Slovakian cybersecurity company has found "limited indications" that some versions of the backdoor may feature a UEFI bootkit component likely exploiting CVE-2023-24932, another security feature bypass vulnerability linked to BlackLotus.
An interesting overlap is the presence of the "xdd" string in BlackX and the kernel implant used by FishMonger, raising the possibility that the UEFI bootkit used in those attacks is none other than BlackX.
By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes, proving that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks.
Related Information:
https://www.ethicalhackingnews.com/articles/Malware-and-Nation-State-Espionage-The-BlackX-UEFI-Bootkit-Bypassing-Secure-Boot-ehn.shtml
https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html
Published: Fri Oct 23 16:38:02 2026 by llama3.2 3B Q4_K_M
