FHN 
Keeping Windows updated may not be enough to stop every advanced cyberattack. A newly reported threat called BlackX shows how attackers can target the software that runs before the operating system even starts.
The malware has been discovered in cyberespionage operations targeting diplomatic organizations in Central Asia, including Tajikistan, Uzbekistan, and Turkmenistan. According to Securelist’s research published on October 22, 2026, the attackers use a bootkit to establish a foothold deep within the computer’s startup process.
The technique gives the attackers an opportunity to interfere with security controls, hide malicious activity, and deploy additional spying tools. Researchers also found similarities between BlackX and the previously documented BlackLotus bootkit.
A Hidden Threat Below Windows
BlackX abuses a known weakness called Baton Drop, tracked as CVE-2022-21894. This vulnerability can be used to bypass Secure Boot protections under affected configurations.
Secure Boot checks whether startup components can be trusted before allowing them to run. BlackX takes advantage of vulnerable, trusted boot components to load unauthorized EFI code during startup.
The malware is deployed after attackers have already gained administrator-level access to a target system. Its installer, inst.exe, uses an encrypted file named PVMDIJGKAX2 to help install the required components.
Once established, BlackX attempts to make security monitoring less effective. Its driver interferes with Windows mechanisms used to observe processes, threads, registry activity, and system events.
Researchers also described a technique intended to disguise malicious files during file-access operations. These capabilities can complicate investigations and make the infection more difficult to identify using ordinary security checks.
The threat is especially concerning because boot-level malware operates at a different stage from conventional applications. Removing a suspicious file may not be enough to restore trust in a compromised system.
Espionage Capabilities Extend Beyond the Bootkit
BlackX serves as part of a broader attack chain rather than acting alone. Additional malware gives the operators ways to maintain remote access and collect information from infected computers.
One component functions as a remote-access Trojan and can load extra .NET modules. It can also use cloud storage services such as Google Drive, OneDrive, and Yandex.Disk to communicate with remote infrastructure.
Another tool, which researchers call OxiDLLRunner, decrypts a file named v8_context_snapshot.bin and launches a Rust-based payload that contacts a command-and-control server.
Securelist assesses that the campaign may be connected to APT41, but assigns only medium confidence to that attribution. The available technical similarities are indicators, not conclusive proof of who operated the attacks.
Why Security Updates May Not Be Enough
The investigation highlights a gap between installing Windows updates and completing the full set of Secure Boot protections.
The relevant defense includes revoking trust in vulnerable boot components signed with the Windows Production PCA 2011 certificate. This is a separate deployment step from installing ordinary Windows updates.
Microsoft’s instructions for CVE-2023-24932 explain that the process involves updating boot components and certificates and applying the appropriate UEFI revocation information. Until the required protections take effect, an updated operating system may still have a weakness in its startup trust chain.
Organizations should review Microsoft’s official Secure Boot deployment guidance and verify the actual state of their devices. Changes should be tested carefully because revoking older boot components can affect recovery media and other startup options.
Security teams should also investigate unusual administrator activity, unexpected boot changes, suspicious EFI components, and signs that endpoint monitoring has been tampered with.
The key takeaway: Defending against advanced bootkits requires more than keeping Windows current. Organizations must also verify firmware-level protections, maintain reliable recovery options, and investigate signs of compromise that may occur before the operating system loads.
Indicators of compromise
| Type | Indicator |
|---|---|
| Installer file | inst.exe |
| Encrypted file | PVMDIJGKAX2 |
| Installer path and command line | C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1 |
| Delivered executable name | googleupdate.exe |
| Original filename | jcef_helper.exe |
| MD5 | AF8A983B9ADA07EAE1259BF2953ABD40 |
| Related payload file | v8_context_snapshot.bin |
| Reported command-and-control domain | www[.]archivetj[.]com |
| Driver certificate serial number | 0bcdf5e0da32d68900b8b7638459d072 |
About the Author
