Isophoric News · Tuesday, October 27, 2026
Kaspersky researchers reported a bootkit called BlackX that used a Windows flaw first patched in 2022 against diplomatic targets in Central Asia, on systems that lacked a manual step
BleepingComputer and The Hacker News, both citing a Kaspersky technical report, said a new UEFI bootkit named BlackX was used in an espionage campaign against diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. It exploited a flaw tracked as CVE-2022-21894, known as Baton Drop, to bypass Secure Boot. According to Kaspersky as relayed by both, the victims ran fully patched Windows, but the patch's certificate revocation does not apply automatically and administrators have to trigger it by hand, which they had not done. BleepingComputer reported Kaspersky attributed the activity with medium confidence to APT41, a Chinese state-linked group; The Hacker News called the attribution suspected. Both outlets said BlackX is very similar to BlackLotus, a bootkit that exploited the same flaw, and that Kaspersky concluded the operator either reverse-engineered BlackLotus or bought its source code, because some code in BlackX was not in BlackLotus's incomplete public leak. Both said the bootkit loads a kernel driver that interferes with security products and then installs espionage tools; some of its tampering runs only when Kaspersky or Avast products are present, which Kaspersky found to be ineffective against its own. The Hacker News quoted a Microsoft statement from earlier years that such a bootkit is a persistence mechanism that needs prior administrator or physical access. Both reported that a Microsoft certificate involved expired on 19 October, and that the expiry does not stop the vulnerable files loading unless the certificate is also blocklisted.
