Kaspersky reports BlackX attacks on patched Windows systems
Kaspersky says attackers exploited missing Secure Boot revocations on patched Windows systems to maintain covert access to diplomatic networks in Central Asia.
Loading… Բեռնվում է…
Kaspersky says attackers exploited missing Secure Boot revocations on patched Windows systems to maintain covert access to diplomatic networks in Central Asia.
Kaspersky says attackers deployed BlackX malware against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026, according to The Hacker News. The cybersecurity company found that attackers could exploit a previously patched Windows startup flaw on computers whose administrators had not applied separate Secure Boot revocations.
BlackX is a bootkit: malware that runs during startup, before the operating system loads. Kaspersky assesses it as an updated version of BlackLotus, an earlier bootkit advertised on cybercrime forums in late 2022. The reported purpose is to undermine Windows startup defenses and security software while keeping long-term, hidden access to compromised devices.
The observed BlackX deployments came after attackers had breached victim networks and gained administrator privileges. The initial intrusion method and the number of victims remain undisclosed. Microsoft’s earlier guidance on BlackLotus describes bootkit deployment as a way to retain access and evade defenses, not as an initial break-in method: attackers must already have privileged or physical access to the device.
Researchers observed espionage software delivered by BlackX that could gather system information and upload files. BlackX also attempts to interfere with security software, although Kaspersky found that certain routines intended to do this were ineffective.
Kaspersky suspects APT41, a China-linked state-sponsored hacking group, was behind the campaign. One reported clue is a shared text string in BlackX and malicious code used by FishMonger, a group assessed to operate under APT41's umbrella. That overlap suggests a possible connection rather than proving common authorship.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
Secure Boot is a startup safeguard intended to prevent unauthorized software from loading. According to Kaspersky, BlackX exploits CVE-2022-21894, also called Baton Drop, to bypass that safeguard and load malicious code before Windows starts. Microsoft has patched the flaw, but the investigation found attackers exploiting systems where the additional revocation measures had not been applied.
Installing an update and applying a revocation do different jobs. The additional mitigation puts the “Windows Production PCA 2011” signing certificate on Secure Boot’s forbidden list, known as DBX. This blocks vulnerable programs signed with that certificate from loading during startup.
The researchers said the certificate expired on October 19, 2026, but expiration alone does not prevent those programs from loading unless the certificate is also blocked. For administrators, the additional mitigation described in the investigation is to apply Microsoft’s Secure Boot revocations alongside Windows updates.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min