hacker-news · Crawled Oct 24, 2026
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
4 IoCs 2 Actors 2 Malware
Read original article ↗
AI Summary
A sophisticated UEFI bootkit named BlackX has been used to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan, in early 2026. The bootkit exploits the CVE-2022-21894 vulnerability (Baton Drop) to bypass Secure Boot, even on patched systems that have not applied manual revocation updates. The attack is attributed to the China-linked APT41 group, leveraging techniques similar to the BlackLotus bootkit. The malware installs a malicious driver signed with a revoked certificate and deploys espionage payloads, including a .NET-based remote access trojan and a Rust-based DLL sideloaded via googleupdate.exe that communicates with 'archivetj[.]com'.
AI-extracted · verify before operational use
Extracted Entities 4 found
Indicators of Compromise 4 extracted
MITRE ATT&CK TTPs 37 techniques
T1006 Direct Volume Access · Defense Evasion T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078.001 Default Accounts · Defense Evasion T1218.001 Compiled HTML File · Defense Evasion T1542.001 System Firmware · Persistence T1003 OS Credential Dumping · Credential Access T1003.001 LSASS Memory · Credential Access T1018 Remote System Discovery · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1036 Masquerading · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1059.003 Windows Command Shell · Execution T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1095 Non-Application Layer Protocol · Command And Control T1105 Ingress Tool Transfer · Command And Control T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1135 Network Share Discovery · Discovery T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1170 T1170 T1197 BITS Jobs · Defense Evasion T1204.002 Malicious File · Execution T1205.001 Port Knocking · Defense Evasion T1210 Exploitation of Remote Services · Lateral Movement T1485 Data Destruction · Impact T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1573.001 Symmetric Cryptography · Command And Control