BlackX UEFI Bootkit Found Bypassing Secure Boot via Unrevoked Signed Loaders on Patched Systems

What happened

Kaspersky has published a technical report on a previously undocumented UEFI bootkit it calls BlackX, used in a targeted campaign against diplomatic organizations in Central Asia — specifically entities in Tajikistan, Uzbekistan, and Turkmenistan — observed in early 2026. Kaspersky suspects the activity is orchestrated by APT41, a China-linked state-sponsored group, though attribution is described as suspected rather than confirmed. According to the report, BlackX is able to bypass Secure Boot on systems that are otherwise fully patched, by relying on firmware components that are legitimately signed but have not yet been added to the Secure Boot revocation list.

Why it matters for defenders

Bootkits that persist below the OS at the UEFI layer are extremely difficult to detect and remove with conventional endpoint tooling, since they can survive OS reinstalls and often execute before security agents load. A technique that works against patched systems is particularly concerning because it undermines the usual assumption that current patch levels equal current protection — the gap here is in revocation coverage, not in a missing OS or firmware update. Organizations with diplomatic, governmental, or other high-value targeting profiles — the apparent focus of this campaign — should treat this as a reminder that Secure Boot's effectiveness depends on an up-to-date revocation list (DBX), not just enabled status.

What defenders should watch for or do now

• Verify that UEFI Secure Boot revocation lists (DBX) are current on managed fleets, and track vendor/Microsoft guidance on revocation updates tied to this disclosure as it emerges.
• Where available, use firmware/UEFI integrity attestation (e.g., TPM-based measured boot logs, vendor firmware scanning tools) to look for unexpected or unsigned-but-trusted boot components.
• Hunt for anomalous EFI system partition modifications, unexpected boot managers/loaders, or unusual pre-OS execution artifacts reported by endpoint detection platforms that support firmware-level visibility.
• Prioritize this hardening for high-risk user populations (diplomatic staff, government, defense-adjacent organizations) given the apparent targeting pattern, pending further detail from Kaspersky.
• Monitor for IOCs and technical indicators as Kaspersky's research is further disseminated; at this stage specific file hashes or detection signatures from the report were not included in the summary available to us.

Developing story

This is net-new threat intelligence based on a single vendor report, and details — including full attribution, scope of victims, and specific indicators of compromise — may evolve as more analysis is published. Read the original report at The Hacker News for further technical detail.