[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNsKbCKmLwW8cZzAUe8hU229zCEV_B0Dd9AgijlHY1eU":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"3efa3b9c-7db2-426c-bdc6-34457f7c23d9","Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware","hackers-revive-blacklotus-techniques-to-bypass-windows-secure-boot-and-deploy-ma-7d7822","Hackers have revived techniques associated with the BlackLotus bootkit to bypass Windows Secure Boot and deploy espionage malware against diplomatic organizations in Central Asia. The new bootkit, named BlackX, appeared in attacks targeting agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Investigators linked the campaign to APT41 with medium confidence, leaving attribution short of […] The post Hackers Revive BlackLotus Techniques to Bypass Windows Secure Boot and Deploy Malware appeared first on Cyber Security News.","Hackers have revived BlackLotus bootkit techniques with a new tool called BlackX to bypass Windows Secure Boot and deploy espionage malware. The attacks targeted diplomatic organizations in Central Asia, with investigators linking the campaign to APT41 with medium confidence. BlackX exploits CVE-2022-21894 to manipulate the startup trust chain, allowing it to inject malicious drivers and deploy espionage payloads.","Hackers revive BlackLotus bootkit techniques with BlackX to bypass Windows Secure Boot and deploy malware.","https:\u002F\u002Fcybersecuritynews.com\u002Fblacklotus-techniques\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHackers-Revive-BlackLotus-Techniques-to-Bypass-Windows-Secure-Boot-and-Deploy-Malware.webp","2026-10-27T01:43:07+00:00","2026-10-27T02:00:06.967616+00:00",9,[17,20,23,26],{"name":18,"type":19},"APT41","threat_actor",{"name":21,"type":22},"Baton Drop","campaign",{"name":24,"type":25},"Windows Secure Boot","product",{"name":27,"type":25},"OxiDLLRunner","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44,49],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":28,"icon":30,"name":31,"slug":32},[52],{"type":53,"value":54,"context":55},"cve","CVE-2022-21894","Exploited by BlackX to manipulate the startup trust chain.",[24,27],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[147],{"slug":102,"name":103,"logo_path":104,"roles":148},[149],"affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"blackx-bootkit-revives-unpatched-cve-to-bypass-secure-boot","BlackX Bootkit Revives Unpatched CVE to Bypass Secure Boot","Attackers exploited CVE-2022-21894, a vulnerability patched by Microsoft in January 2022, to bypass Windows Secure Boot and deploy persistent espionage malware against diplomatic targets in Central Asia. The fact that this vulnerability remains weaponizable years after its patch release highlights a systemic failure in patch management and firmware-level security hygiene. By manipulating the startup trust chain, BlackX can inject malicious drivers before the OS loads, making detection and removal exceptionally difficult. This matters because bootkits operate beneath traditional security controls, rendering endpoint protection tools largely ineffective once a system is compromised.",[155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1542.003: Pre-OS Boot: Bootkit","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"MITRE ATT&CK T1542.003: Pre-OS Boot: Bootkit":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":169},"NIS2 requires essential entities, including diplomatic organizations, to implement incident handling and vulnerability management measures; the prolonged exposure of CVE-2022-21894 indicates neither requirement was adequately met.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule; timely application of Microsoft's Secure Boot patch would have directly prevented this exploit.","BlackX directly implements the Bootkit sub-technique by modifying the UEFI\u002FSecure Boot trust chain to persist malicious code before the OS loads, making this ATT&CK reference the precise adversary behavior defenders must detect and mitigate.","The attack succeeded because vulnerable Secure Boot components remained unpatched in the environment, reflecting the same risk OWASP A06 warns against—failure to track and update components with known vulnerabilities.","CVE-2022-21894 had a vendor patch available for years; a continuous vulnerability management program with enforced remediation SLAs would have ensured this critical flaw was closed before attackers could weaponize it.","This control mandates timely identification and remediation of technical vulnerabilities, which would have compelled patching of CVE-2022-21894 and reduced the attack surface exploited by BlackX.","By injecting malicious kernel-mode drivers, BlackX circumvents OS-level authentication and access controls entirely; enforcing Secure Boot policy and driver signing requirements is a prerequisite access control that would have blocked unauthorized code execution at boot time."]