BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems

A newly discovered Unified Extensible Firmware Interface (UEFI) bootkit named BlackX has been shown to bypass Secure Boot on Windows computers that received recent patches ¹. The exploit operates below the operating system level, allowing it to load malicious code before Windows drivers or OS components start running.

The activity singled out diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan during early 2026 according to a technical report by Kaspersky ¹. Analysts believe the operation was orchestrated by the state‑sponsored hacking group APT41.

Experts explain that UEFI firmware resides outside the OS, making this attack vector persistent and difficult to detect with conventional antivirus tools alone. Similar tactics were seen in Operation Aurora in 2009 when attackers used low‑level code execution within pre‑boot environments to compromise Google systems without triggering standard security measures.

Revocation of such vulnerabilities often lags behind patching because motherboard manufacturers must update BIOS updates—a process that can take months or longer, leaving devices exposed even after official fixes are released ¹.

Because BlackX runs at boot time, detection requires specialized deep inspection tools focused specifically against firmware attacks rather than post‑operation user‑space monitoring. Microsoft’s Defender team is expected to release updated signatures soon; however, recovery will require thorough hardware diagnostics performed by trained specialists who can verify whether firmware updates have been applied correctly and whether any unauthorized modifications exist on the device’s storage media.

The incident underscores a growing trend where adversaries target firmware layers to achieve long‑term access. By bypassing Secure Boot on patched systems, BlackX demonstrates that even up‑to‑date operating systems cannot guarantee protection if the underlying firmware remains vulnerable.

Organizations handling sensitive diplomatic data should review their firmware management processes, ensuring all devices receive timely BIOS updates from reputable vendors and that integrity checks for UEFI components are enforced during system startup.

Experts caution that similar rootkits may already be in circulation targeting other sectors. Continuous vigilance combined with proactive firmware patching and dedicated forensic analysis will remain essential defenses against this class of attacks.