Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware
Hackers revive BlackLotus bootkit techniques with BlackX to bypass Windows Secure Boot and deploy malware.
Run Windows Secure Boot?
Get an email when a reviewed story names Windows Secure Boot, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Hackers have revived BlackLotus bootkit techniques with a new tool called BlackX to bypass Windows Secure Boot and deploy espionage malware. The attacks targeted diplomatic organizations in Central Asia, with investigators linking the campaign to APT41 with medium confidence. BlackX exploits CVE-2022-21894 to manipulate the startup trust chain, allowing it to inject malicious drivers and deploy espionage payloads.
The lesson from this incident
Full lessonAttackers exploited CVE-2022-21894, a vulnerability patched by Microsoft in January 2022, to bypass Windows Secure Boot and deploy persistent espionage malware against diplomatic targets in Central Asia. The fact that this vulnerability remains weaponizable years after its patch release highlights a systemic failure in patch management and firmware-level security hygiene. By manipulating the startup trust chain, BlackX can inject malicious drivers before the OS loads, making detection and removal exceptionally difficult. This matters because bootkits operate beneath traditional security controls, rendering endpoint protection tools largely ineffective once a system is compromised.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2022-21894