BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
BlackX UEFI bootkit targets Central Asian diplomatic organizations, suspected APT41 activity.
Summary
A new UEFI bootkit named BlackX has been observed targeting diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The sophisticated malware is capable of bypassing Secure Boot on patched Windows systems that lack necessary revocations. Security researchers suspect the China-linked state-sponsored threat actor APT41 is behind this campaign.
The lesson from this incident
Full lessonThe BlackX bootkit campaign demonstrates that simply applying OS patches is insufficient when firmware-level revocations — which invalidate compromised or vulnerable UEFI boot components — are not also applied. Diplomatic organizations in Central Asia were compromised because their systems lacked critical UEFI Secure Boot revocation database (dbx) updates, leaving a pathway open for the malware to bypass boot integrity checks entirely. This matters enormously because a UEFI bootkit persists below the operating system, surviving reinstalls, antivirus scans, and traditional remediation. The gap between 'patched' and 'fully hardened' at the firmware layer is a blind spot in most patch management programs, and state-sponsored actors like APT41 actively exploit this oversight.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- malware — BlackX