Covered by 2 outlets — first reported by The Hacker News, Oct 23, 18:50 UTC
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
In brief
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
From The Hacker News's coverage.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.
BleepingComputer
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and…
Explained
The technology and terms in this story. Learn more
- TechnologyUEFIThe firmware that starts a computer before the operating system loads.
- AttackBootkitMalware that infects the boot process so it runs before the operating system.
- DefenceSecure BootA firmware check that only lets signed, trusted boot loaders start the computer.
- ConceptAPT · Advanced persistent threatA well-resourced hacking group, usually tied to a government, that runs long, targeted campaigns.