APT41 BlackX UEFI bootkit bypasses Secure Boot via unrevoked Baton Drop certificate (CVE-2022-21894)
Severity: high · Patch status: partial · Since 2026-10-23 · CVE-2022-21894
Kaspersky reports a new UEFI bootkit, BlackX, used in an early-2026 espionage campaign against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan, attributed with medium confidence to China-linked APT41. BlackX is a copycat of BlackLotus, exploiting the Baton Drop flaw (CVE-2022-21894) on fully patched Windows systems where admins never manually applied Secure Boot DBX revocations of the 'Windows Production PCA 2011' certificate (which expired 2026-10-19 but still loads vulnerable binaries unless blocklisted). The bootkit enrolls Machine Owner Keys, injects a kernel driver signed with a now-revoked certificate to tamper with security software and ETW, and drops a cloud-C2 RAT plus OxiDLLRunner (Rust payload via googleupdate.exe sideloading, C2 archivetj[.]com). Full remediation requires manual Secure Boot revocation steps beyond installing updates.
What to do
- Manually apply Microsoft's Secure Boot revocation mitigations: add 'Windows Production PCA 2011' to the UEFI Forbidden Signature Database (DBX), following Microsoft's CVE-2022-21894 guidance
- Verify DBX revocations are actually present on endpoints, since patch installation alone does not enforce them
- Hunt for indicators: inst.exe under C:\ProgramData\Intel\, PVMDIJGKAX2 encrypted payload file, OxiDLLRunner, googleupdate.exe sideloading, and traffic to archivetj[.]com
- Restrict and monitor administrator privileges and physical access, prerequisites for bootkit deployment
- Monitor for tampering with security processes, registry callbacks, and ETW providers; ensure EDR tamper protection is enabled
Sources
All live incidents on Threat Watch
