BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Summary
A sophisticated UEFI bootkit named BlackX has been identified targeting diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The attack campaign, which began in early 2026, is attributed to the China-linked state-sponsored hacking group APT41.
IFF Assessment
The discovery of a new, sophisticated UEFI bootkit used in targeted attacks against diplomatic entities represents a significant threat and advancement for attackers.
Defender Context
This discovery highlights the ongoing threat of advanced UEFI bootkits capable of bypassing security measures like Secure Boot, even on patched systems. Defenders should be aware of the potential for firmware-level compromises and ensure robust endpoint detection and response capabilities, alongside diligent firmware integrity checks.