New BlackX Bootkit Sneaks Past Secure Boot on Patched Windows

Robert Moore · 2026-10-23

Diplomatic organizations in Central Asia have been targeted by a sophisticated new UEFI bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report. ### What Makes BlackX Different BlackX is a UEFI bootkit, meaning it infects the firmware that runs before Windows even starts. This allows it to bypass Secure Boot, a security feature designed to prevent unauthorized code from running during the boot process. The bootkit exploits missing revocations on patched Windows systems, according to the report. In simple terms, even if your Windows is up to date, BlackX can still slip through if certain certificates haven't been revoked. That's a scary thought for anyone relying on Secure Boot as a line of defense. ### Who Is Behind BlackX? Kaspersky attributes the campaign to APT41, a notorious group linked to the Chinese government. APT41 has a history of espionage and financially motivated attacks. Targeting diplomatic entities in Central Asia fits their pattern of seeking geopolitical intelligence. ### Why This Matters to You You might not be a diplomat, but this attack highlights a broader issue: firmware-level threats are on the rise. They're hard to detect and even harder to remove. Traditional antivirus often misses them because they operate below the operating system. "Firmware attacks are the new frontier," says a security researcher. "They remind us that security is only as strong as its weakest layer." ### How to Protect Yourself While BlackX specifically targets high-value diplomatic targets, the techniques could be reused. Here are some steps to stay safe: - Keep your system firmware updated. Check your manufacturer's website for BIOS/UEFI updates. - Enable Secure Boot and ensure your revocation lists are current. - Use hardware-based security features like TPM 2.0. - Monitor for unusual boot behavior, such as unexpected reboots or firmware warnings. - Consider endpoint detection and response (EDR) solutions that monitor firmware integrity. ### The Bigger Picture BlackX is a reminder that cybersecurity is a cat-and-mouse game. As defenses improve, attackers find new ways around them. Staying informed and proactive is your best bet. For now, if you're in a high-risk industry, it's worth reviewing your firmware security posture. And for everyone else, keep those updates coming—and don't ignore firmware.