[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdn6Mvkmu9PPYWIaB5xkUEckjr3bxsJa_ctyRE4FzkjM":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"d18e8cc5-92b1-4ebc-a770-2586a89ad0ec","BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations","blackx-uefi-bootkit-bypasses-secure-boot-on-patched-windows-systems-missing-revo-68f2c8","Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report","A new UEFI bootkit named BlackX has been observed targeting diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The sophisticated malware is capable of bypassing Secure Boot on patched Windows systems that lack necessary revocations. Security researchers suspect the China-linked state-sponsored threat actor APT41 is behind this campaign.","BlackX UEFI bootkit targets Central Asian diplomatic organizations, suspected APT41 activity.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fblackx-uefi-bootkit-bypasses-secure.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj0cTK7D5hQFR-3qGTicTlfi6_CbnMIgCJWIojDeXmZr91hrIPqhhxZ72mAsnB6kBOcCdscZOL_VN8RhAdYIxq3d128rkaDweIApSaV5w3IzB1YGN3XNnlarG0IKN5VuDJy_RnPBxXZoKQ1Yh950YFNz-b_pbvEY_QlQa5Tr-BP4366UgkGIg968J-QEN1M\u002Fs1600\u002Fuefi.jpg","2026-10-23T18:50:13+00:00","2026-10-23T19:00:07.412789+00:00",9,[17,20,23],{"name":18,"type":19},"APT41","threat_actor",{"name":21,"type":22},"UEFI","technology",{"name":24,"type":22},"Secure Boot","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":25,"icon":27,"name":28,"slug":29},null,"Nation-state","nation-state",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":42,"value":50,"context":51},"BlackX","UEFI bootkit name",[],{"controls":54,"vendors":138},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":47,"name":114,"problem":115,"products":116},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[117,125,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":126,"product_name":127,"url":128,"description":129},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[139],{"slug":140,"name":141,"logo_path":142,"roles":143},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"blackx-uefi-bootkit-exploits-missing-secure-boot-revocations-on-patched-windows-systems","BlackX UEFI Bootkit Exploits Missing Secure Boot Revocations on Patched Windows Systems","The BlackX bootkit campaign demonstrates that simply applying OS patches is insufficient when firmware-level revocations — which invalidate compromised or vulnerable UEFI boot components — are not also applied. Diplomatic organizations in Central Asia were compromised because their systems lacked critical UEFI Secure Boot revocation database (dbx) updates, leaving a pathway open for the malware to bypass boot integrity checks entirely. This matters enormously because a UEFI bootkit persists below the operating system, surviving reinstalls, antivirus scans, and traditional remediation. The gap between 'patched' and 'fully hardened' at the firmware layer is a blind spot in most patch management programs, and state-sponsored actors like APT41 actively exploit this oversight.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1542.003: Pre-OS Boot: Bootkit","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 17: Incident Response Management":160,"MITRE ATT&CK T1542.003: Pre-OS Boot: Bootkit":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 requires essential entities — including diplomatic and government organizations — to implement incident handling and security measures covering firmware and supply-chain risks; the missing revocations represent a failure of the baseline security hygiene NIS2 mandates for critical-sector organizations.","SI-2 mandates identifying, reporting, and correcting information system flaws — including firmware and bootloader vulnerabilities — within defined timeframes, which would have required the missing UEFI dbx revocations to be applied as critical remediations.","A mature incident response capability with UEFI-aware forensic procedures is essential for detecting and recovering from bootkit infections that persist below the OS layer, which is especially critical for state-sponsored APT41 intrusions targeting diplomatic organizations.","BlackX is a direct implementation of this technique, targeting the pre-OS boot environment to achieve persistence that survives OS reinstallation; mapping defenses to this ATT&CK technique would have driven firmware hardening and Measured Boot controls.","This control requires organizations to continuously track and remediate vulnerabilities including firmware-level flaws; had diplomatic organizations applied UEFI revocation updates as part of a systematic vulnerability management cycle, the bootkit's Secure Boot bypass would have been blocked.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, explicitly including firmware and boot-integrity patches that would have closed the Secure Boot bypass exploited by BlackX.","Secure Boot functions as a hardware-rooted authentication mechanism for the boot process; ensuring revocations are current directly supports the integrity of this boot-time access control, preventing unauthorized (malicious) bootloaders from executing."]