BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
A new UEFI bootkit, BlackX, linked to China's APT41, is targeting diplomatic organizations in Central Asia by exploiting unpatched Secure Boot revocation steps for CVE-2022-21894.
Intelligence analysis by Gemini 2.5 Flash
BlackX, an advanced UEFI bootkit, is being deployed by the state-sponsored hacking group APT41 against diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan. It's an evolved version of BlackLotus, designed to bypass Windows Secure Boot defenses and third-party security solutions by leveraging organizations' failure to apply manual revocation mitigations for a known vulnerabi…
Imagine your computer has a special bouncer called Secure Boot that checks if all the programs starting up are good guys. But there was a secret back door that the bouncer didn't know about, even after getting a new rulebook. Bad guys found this back door, called BlackX, and are using it to sneak in their own sneaky programs before the bouncer even starts checking. They get in because some computer owners didn't update the bouncer's 'bad guy list' properly, even after getting the new rulebook. This lets the sneaky programs hide deep inside and spy on everything.
Analysis
The emergence of BlackX signifies a concerning evolution in state-sponsored cyber espionage capabilities, particularly from groups like APT41. This bootkit, identified by Kaspersky, is not merely a new piece of malware but an adaptation of the notorious BlackLotus, indicating a strategic investment by threat actors to leverage proven, sophisticated techniques. The targeting of diplomatic organizations in Central Asia underscores the geopolitical motivations behind such attacks, aiming for long-term, covert access to sensitive information and systems. The fact that BlackX's source code was either reverse-engineered or purchased from cybercrime actors by an APT group is a rare and significant observation, blurring the lines between state-sponsored and criminal methodologies and suggesting a pragmatic approach to acquiring advanced tools.
CVE-2022-21894
At the heart of BlackX's success is the exploitation of CVE-2022-21894, also known as Baton Drop, a Secure Boot bypass vulnerability. While Microsoft released a patch for this vulnerability, the article emphasizes that the patch alone is insufficient. Complete mitigation requires organizations to perform additional manual steps, specifically adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX). Many organizations have evidently failed to implement these crucial revocation mitigations, creating a persistent window of opportunity for attackers. BlackX capitalizes on this oversight, allowing it to load malicious code before the operating system starts, effectively bypassing Secure Boot even on systems that have applied the initial software update. This highlights a critical gap in cybersecurity practices, where the full scope of a vulnerability's remediation is often overlooked.
APT41
APT41, a China-linked state-sponsored hacking group, is strongly suspected to be behind the BlackX campaign. This attribution stems from connections identified by ESET, linking the group (also known as FishMonger, Aquatic Panda, and Earth Lusca) to the use of the SprySOCKS backdoor in previous attacks. The deployment of BlackX by APT41 demonstrates their continued sophistication and strategic focus on high-value targets. After gaining initial access and administrator privileges, the threat actors deploy BlackX by dropping an installer executable and an encrypted file. The installation process, which involves an RC4 key for decryption, is remarkably similar to BlackLotus, leading to the installation of Machine Owner Keys (MOK) to load arbitrary EFI files. Post-exploitation, the UEFI payload injects a malicious driver into the Windows kernel, signed with a revoked certificate, which attempts to tamper with endpoint security software. Furthermore, the driver deploys user-mode payloads for cyber espionage, including a remote access trojan utilizing cloud services like Google Drive and OneDrive for command-and-control, and a Rust payload (OxiDLLRunner) for executing additional DLL plugins, showcasing a multi-layered approach to compromise and data exfiltration.
Key points
- BlackX is a new UEFI bootkit linked to China-backed APT41, targeting diplomatic organizations in Central Asia.
- It is an updated version of the BlackLotus bootkit, exploiting CVE-2022-21894 (Baton Drop) to bypass Secure Boot.
- The bootkit succeeds because many organizations fail to apply manual Secure Boot revocation mitigations, even after installing patches.
- BlackX injects a malicious kernel driver, tampers with security software, and deploys cyber espionage payloads like a RAT and OxiDLLRunner.
- The threat actors likely reverse-engineered BlackLotus or acquired its source code, indicating a sophisticated approach to tool development.
The identification of BlackX and its tactics by Kaspersky provides crucial intelligence for organizations to strengthen their defenses. With the certificate used to sign the malicious driver now revoked, and awareness raised about the necessity of manual Secure Boot revocation steps, organizations have a clearer path to fully mitigate this threat.
The continued success of BlackX highlights a significant failure in cybersecurity hygiene, where organizations neglect critical manual mitigation steps for known vulnerabilities. This oversight allows sophisticated state-sponsored actors like APT41 to maintain deep, persistent, and stealthy access, posing a severe long-term risk to national security and diplomatic integrity.
