BlackX UEFI bootkit Baton Drop zaifligidan foydalanib Secure Boot'ni chetlab o'tadi

BlackX UEFI bootkit Baton Drop zaifligidan foydalanib Secure Boot'ni chetlab o'tadi

Bill Toulas tomonidan

2026-yil 24-oktabr

10:17

0

BlackX deb nomlangan yangi UEFI bootkit 2026-yil boshida josuslik kampaniyasida qo'llanilgan bo'lib, eski Baton Drop zaifligidan foydalanib Secure Boot'ni chetlab o'tgan va Kaspersky hamda Avast xavfsizlik yechimlariga xalaqit berish uchun mo'ljallangan zararli drayverni yuklagan.

Operatsiya o'rta ishonch bilan APT41 — Brass Typhoon, Wicked Panda va Barium nomlari bilan ham tanilgan Xitoy davlat homiyligidagi tahdid guruhiga bog'langan.

U 2026-yil boshida aniqlangan va Markaziy Osiyodagi diplomatik agentliklarga, xususan Tojikiston, O'zbekiston va Turkmanistondagi agentliklarga qaratilgan.

Kaspersky tadqiqotchilari BlackX bootkitini tahlil qilib, 2022-yil oktyabridan beri xaker forumlarida tarqalgan va Secure Boot himoyasini chetlab o'tish uchun Baton Drop zaifligidan (CVE-2022-21894) foydalangan BlackLotus bilan o'xshashliklarni topdilar.

ESET 2023-yil mart oyida BlackLotus Baton Drop'dan foydalanganini tasdiqlagan va o'sha paytda u hatto to'liq yangilangan Windows 11 tizimlarini ham buzishi mumkin edi.

Kaspersky tadqiqotchilariga ko'ra, BlackX'dagi ekspluatatsiya amalga oshirilishi BlackLotus'da ishlatilganiga "hayratlanarli darajada o'xshash" bo'lib, bu hujumchiga maxsus Machine Owner Keys (MOK) larni ro'yxatdan o'tkazish va Secure Boot himoyasini chetlab o'tish uchun ixtiyoriy EFI fayllarini yuklash imkonini bergan.

Biroq BlackX BlackLotus'dan farq qiladi va boshqa yadro drayveri hamda keyingi yuklamalarni joylashtiradi. Kaspersky BlackX BlackLotus'ni teskari muhandislik qilish yoki uning manba kodidan olingan deb taxmin qiladi.

BlackLotus manba kodi 2023-yil iyul oyida sizdirilgan bo'lsa-da, chiqarilish to'liq emas edi. Kaspersky tadqiqotchilari tahlil qilgan ba'zi BlackLotus namunalarida ommaviy repozitoriyada yo'q, lekin BlackX bootkitida mavjud kod borligini aniqladilar.

BlackX operatori bu kodni sizdirilgan repodan ololmaganligi sababli, tadqiqotchilar hujumchi BlackLotus'ni teskari muhandislik qilgan yoki uning manba kodini sotib olgan deb hisoblaydilar.

BlackX imkoniyatlari

BlackX Wenjiang District Mingyu Network Technology Service Studio nomli tashkilotga berilgan, hozir bekor qilingan sertifikat bilan imzolangan zararli Windows yadro drayverini kiritadi.

Drayver xavfsizlik bilan bog'liq jarayonlar va ro'yxatga olish qayta chaqiruvlarini o'chiradi, hamda kuzatuvni to'sish uchun Windows Event Tracing (ETW) provayderlarini buzadi.

Tadqiqotchilar ba'zi buzish protseduralari faqat maqsadli xostda Kaspersky yoki Avast mahsulotlari aniqlanganda ishlashga sozlanganini ta'kidlaydilar va bu mexanizm kompaniya yechimlariga qarshi foydasiz ekanligini qo'shadilar.

Drayver shuningdek bootkit fayllarini foydalanuvchilarning ularni ochish so'rovlarini ushlab qolish va o'rniga Windows Kalkulyatorini ishga tushirish orqali himoya qiladi.

Uning maqsadi shuningdek zararlangan mashinalarda quyidagi josuslik yuklamalarini joylashtirishdir:

• Google Drive, OneDrive yoki Yandex.Disk'dan foydalanib buyruq va nazorat (C2) uchun RAT, .NET yuklamalarini bajarish va fayllarni yuklash/yuklab olish uchun.
• OLLVM bilan xiralashtirilgan DLL, googleupdate.exe tomonidan yonma-yon yuklanadi. U v8contextsnapshot.bin ni shifrdan ochib, shellcode va Rust yuklamasini ishga tushiradi, bu esa archivetj[.]com'dan DLL plaginlarini oladi va ularning 'create_plugin' funksiyalarini alohida oqimlarda bajaradi.

Yetarli emas tuzatish

Kaspersky BlackX qurbonlarining barchasi to'liq yangilangan Windows relizidan foydalanganini aytadi. Biroq bootkit hali ham muvaffaqiyatli bo'lgan, chunki administratorlar qo'shimcha Secure Boot bekor qilishlarini qo'lda faollashtirmagan.

"Baton Drop zaifligi uchun tuzatish zaif UEFI komponentlarini imzolash uchun ishlatiladigan 'Windows Production PCA 2011' sertifikatini bekor qilish uchun mo'ljallangan," deb tushuntiradi Kaspersky.

"Biroq bu bekor qilish tuzatish o'rnatilganda avtomatik ravishda sodir bo'lmaydi — foydalanuvchi uni qo'lda ishga tushirishi kerak."

Tadqiqotchilar bu yangilanish jarayonidagi bo'shliq ekanligini aytadilar, chunki administratorlar xavfsizlik yangilanishini qo'llagandan so'ng har qanday qo'lda harakat qilishlari juda kam uchraydi.

Ular hujumchi bu yumshatish bo'shligidan o'z foydasiga foydalanib, "BlackLotus qanday ishlashini tushunish va bu bootkitning nusxasini yaratish uchun vaqt sarflashga qaror qilgan" deb hisoblaydilar.

Baton Drop (CVE-2022-21894) ni to'liq tuzatish bo'yicha ko'rsatmalar bu yerda mavjud.

Tadqiqotchilar "Windows Production PCA 2011" sertifikatining 2026-yil 19-oktabrdagi amal qilish muddati tugashi Windows tizimlarida zaif binar fayllarning yuklanishini to'xtatmasligini, agar administratorlar sertifikatni blok ro'yxatiga qo'shmasa, ogohlantiradilar.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi

Umumiy oldini olish ballari dastlabki kirishdan keyin sodir bo'ladigan narsalarni yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.

Blue Report 2026 himoyalarni texnika bo'yicha, mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha o'lchaydi.

Hisobotni oling

Tegishli maqolalar:

DHS AQSh federal fuqarolik agentliklarida DeepSeek mahsulotlarini taqiqladi

Janubiy Koreya bank buzilishlarini AI yordamida hujumlar shubhasida tekshirmoqda

Daniya aholi ro'yxatga olish ma'lumotlari buzilishi 8,8 million kishiga ta'sir qildi

Avtonom AI agentlari AQSh va Kanada hukumat veb-saytlarini buzishga urindi

Microsoft: Xitoy xakerlari AQSh hukumat Exchange elektron pochta hisoblarini buzdi

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

By Bill Toulas

October 24, 2026

10:17 AM

0

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.

The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium.

It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.

Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.

ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.

According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.

However, BlackX differs from BlackLotus and deploys a different kernel driver and follow-on payloads. Kaspersky suggests that BlackX was either derived from reverse-engineering BlackLotus or from its source code.

Although the source code for BlackLotus was leaked in July 2023, the release was incomplete. Kaspersky researchers found that some BlackLotus samples they analyzed contained code missing from the public repository but present in the BlackX bootkit.

Since the BlackX operator could not have obtained this code from the leaked repo, the researchers believe the attacker either reverse-engineered BlackLotus or purchased its source code.

BlackX capabilities

BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio.

The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring.

The researchers note that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host, adding that the mechanism is useless against the company's solutions.

The driver also protects the bootkit’s files by intercepting user requests to open them and launching the Windows Calculator instead.

Its purpose is also to deploy the following espionage payloads on infected machines:

A RAT that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and upload and download files.

OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by googleupdate.exe. It decrypts v8contextsnapshot.bin to launch shellcode and a Rust payload, which retrieves DLL plugins from archivetj[.]com and executes their ‘create_plugin’ functions in separate threads.

Insufficient fix

Kaspersky says that all BlackX victims used a fully patched Windows release. However, the bootkit was still successful because admins did not manually activate the additional Secure Boot revocations.

“The patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components,” Kaspersky explains.

“However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually.”

The researchers say this is a gap in the update process, since it’s extremely uncommon for administrators to take any manual action after applying a security update.

They believe that the attacker used this mitigation gap to their advantage and "decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."

Instructions to fully patch Baton Drop (CVE-2022-21894) are available here.

The researchers warn that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Related Articles:

DHS bans DeepSeek products across US federal civilian agencies

South Korea probes bank breaches amid suspected AI-powered attacks

Denmark population registry data breach affects 8.8 million people

Autonomous AI agents tried to hack US, Canadian government websites

Microsoft: Chinese hackers breached US govt Exchange email accounts