Kaspersky researchers uncovered BlackX, a UEFI bootkit deployed against diplomatic entities in Central Asia in targeted espionage campaigns attributed to Chinese threat actor APT41. The bootkit weaponizes the “Baton Drop” vulnerability (CVE-2022-21894) in the Windows Boot Manager, using an exploit chain derived from BlackLotus. By abusing unrevoked, vulnerable Microsoft-signed bootloaders on EFI system partitions, BlackX executes in the pre-OS environment, enrolls custom Machine Owner Keys (MOKs), and loads arbitrary EFI binaries to subvert UEFI Secure Boot.

During OS initialization, BlackX deploys a kernel driver to unregister object callbacks, blind endpoint security software, and sever Event Tracing for Windows (ETW) telemetry providers before staging modular RATs and obfuscated loaders. Despite vendor patches for CVE-2022-21894, fully updated Windows installations remain vulnerable because Microsoft’s revocation of the “Windows Production PCA 2011” certificate requires manual Secure Boot DBX updates rather than automated installation.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Executing malicious code in the pre-boot phase invalidates the hardware root of trust, neutralizes kernel-mode security drivers, and blindingly subverts OS-level telemetry before endpoint detection hooks can initialize.
• Bullet 2 — Strategic & Defender Imperative: Security teams must move beyond standard Windows Update patching by actively pushing manual Secure Boot DBX revocation updates, auditing firmware hashes, and enforcing Credential Guard and HVCI across all managed endpoints.