Posted on

BlackX UEFI Bootkit — Secure Boot Revocation Gap and Espionage — Microsoft Sentinel Threat Hunts

Threat Overview

Kaspersky GReAT published technical analysis on October 22, 2026 of BlackX, a UEFI bootkit observed during an early-2026 intrusion campaign against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Attackers already had administrator access before installing the bootkit. The installer C:\ProgramData\Intel\inst.exe consumed an encrypted container PVMDIJGKAX2, placed components in system/EFI partitions, and abused the old Baton Drop Secure Boot bypass CVE-2022-21894. Kaspersky found victim Windows machines were patched, but the separate Windows Production PCA 2011 certificate revocation had not been applied. The bootkit installed custom Machine Owner Keys and a kernel driver, then deployed espionage payloads: a cloud-storage-backed RAT and an OxiDLLRunner DLL side-loaded through googleupdate.exe. Kaspersky attributes the operation to APT41 with medium confidence, not certainty. This is a targeted, post-admin compromise technique, not an unauthenticated Windows RCE or evidence of mass exploitation.

References

Impacted Systems

  • Microsoft Windows systems with UEFI Secure Boot, principally Windows endpoints and servers where attackers already possess local administrator privileges. Exact Windows build/edition boundaries for the observed campaign were not published; the exploited boot chain depends on acceptance of a vulnerable Windows Production PCA 2011-signed boot component, not simply an OS version number.
  • Firmware/boot configuration prerequisite: vulnerable boot components remain trusted because the relevant Secure Boot DBX revocation was not completed. A fully patched OS alone may still be exposed; systems with the required revocation enforced are not exposed to this specific certificate trust path.
  • Malware artifacts: C:\ProgramData\Intel\inst.exe, PVMDIJGKAX2, RC4 key Q46F6MDLI3RX2KV1, googleupdate.exe plus v8_context_snapshot.bin, and www.archivetj.com plugin C2; all sourced from Kaspersky’s October 22 analysis.
  • Deployment: post-compromise physical or virtual Windows host with UEFI/Secure Boot; no Internet-facing listener or fixed port is required for the bootkit. Microsoft guidance governs boot-chain revocation and compatibility, not a new vendor fixed build for BlackX.

Why this matters

BlackX illustrates a material blind spot: endpoint patch compliance does not prove Secure Boot certificate revocations were applied. It also combines pre-OS persistence, a signed malicious driver, and cloud-storage C2, limiting traditional endpoint and firewall visibility. Broad MSSP priority is revocation/exposure validation; immediate hunt priority rises for high-value Windows endpoints with the specific artifacts.

Exploitation Status

Confirmed by Kaspersky: malicious sample, installer/encrypted container, bootkit mechanism, two payload families, compromised diplomatic targets and missing certificate revocation. Researcher assessment: APT41 attribution at medium confidence. Not established: exact initial access vector, affected Windows build list, broad victim count, or reliable detection of UEFI modifications from standard Sentinel logs. Historical IOC www.archivetj.com; original-file MD5 AF8A983B9ADA07EAE1259BF2953ABD40 applies to the abused legitimate googleupdate.exe host, not to the malicious DLL itself.

What this hunt looks for

Prepared Sentinel hunts for the exact installer command, encrypted container file, side-loading artifact combination, published plugin C2, suspicious googleupdate.exe execution, EFI/BCD manipulation commands, SecurityEvent 4688 fallback, and firewall hostname pivot. No customer telemetry was reviewed or searched in this run.

Required logs

  • DeviceProcessEvents (Microsoft Defender for Endpoint); only when ingested into Microsoft Sentinel.
  • DeviceFileEvents (Microsoft Defender for Endpoint); only when ingested into Microsoft Sentinel.
  • DeviceNetworkEvents (Microsoft Defender for Endpoint); only when ingested into Microsoft Sentinel.
  • SecurityEvent 4688 with process command-line auditing; only when ingested into Microsoft Sentinel.
  • CommonSecurityLog with appliance/security-event fields; only when ingested into Microsoft Sentinel.

Hunt 01 — BlackX installer exact command and RC4 container

Signal: Very high — campaign-specific

DeviceProcessEvents
| where TimeGenerated >= ago(90d)
| extend C=tolower(ProcessCommandLine), P=tolower(FolderPath)
| where (FileName =~ "inst.exe" and P contains "\\programdata\\intel\\" and C contains "pvmdijgkax2") or C contains "q46f6mdli3rx2kv1"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName
| order by TimeGenerated desc

Detection caveat: Very narrow published artifact; renamed payloads evade this exact-match hunt.

Hunt 02 — Encrypted BlackX installation container written to disk

Signal: Very high — campaign-specific filename

DeviceFileEvents
| where TimeGenerated >= ago(90d)
| where FileName =~ "PVMDIJGKAX2" or (FileName =~ "inst.exe" and FolderPath contains "\\ProgramData\\Intel\\")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

Detection caveat: Exact filename and folder are high confidence but can be changed; absence does not rule out bootkit.

Hunt 03 — OxiDLLRunner side-loading artifact combination

Signal: High — multiple related file artifacts

DeviceFileEvents
| where TimeGenerated >= ago(90d)
| where FileName in~ ("googleupdate.exe","v8_context_snapshot.bin")
| summarize Names=make_set(FileName), Count=count(), First=min(TimeGenerated), Last=max(TimeGenerated), ExamplePaths=make_set(FolderPath,5) by DeviceId, DeviceName, bin(TimeGenerated,1d)
| where set_has_element(Names,"v8_context_snapshot.bin") and set_has_element(Names,"googleupdate.exe")
| project First, Last, DeviceName, Count, Names, ExamplePaths
| order by Last desc

Detection caveat: Google updater binaries and V8 snapshots can be legitimate. The same-day pairing is a triage lead, not proof.

Hunt 04 — Published BlackX plugin C2 destination

Signal: Very high — reported domain

DeviceNetworkEvents
| where TimeGenerated >= ago(90d)
| where RemoteUrl endswith "archivetj.com" or RemoteUrl =~ "www.archivetj.com"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| order by TimeGenerated desc

Detection caveat: Network domain telemetry may be absent for IP-only TLS connections; historical domain could be repurposed.

Hunt 05 — Suspicious googleupdate executable launching from nonstandard folder

Signal: Medium-high when nonstandard path and parent

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "googleupdate.exe"
| extend P=tolower(FolderPath), Parent=tolower(InitiatingProcessFileName)
| where P !contains "\\google\\update\\" and P !contains "\\program files\\google\\" and P !contains "\\program files (x86)\\google\\"
| where Parent !in ("googleupdate.exe","services.exe","taskeng.exe","taskhostw.exe")
| project TimeGenerated, DeviceName, FolderPath, InitiatingProcessFileName, ProcessCommandLine, SHA256, InitiatingProcessCommandLine
| order by TimeGenerated desc

Detection caveat: Legitimate third-party packages may use this name. Verify PE original filename and signature.

Hunt 06 — Suspicious EFI partition manipulation commands

Signal: Medium-high with ESP writes

DeviceProcessEvents
| where TimeGenerated >= ago(90d)
| where FileName in~ ("mountvol.exe","bcdedit.exe","powershell.exe","pwsh.exe","diskpart.exe")
| extend C=tolower(ProcessCommandLine)
| where (C contains " /s" and FileName =~ "mountvol.exe") or (C contains "\\efi\\" and (C contains "copy" or C contains "remove-item" or C contains "move-item")) or (C contains "bcdedit" and (C contains "nointegritychecks" or C contains "testsigning"))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Detection caveat: OS servicing and recovery legitimately touch EFI/BCD. This hunt is behavioral and not BlackX-specific.

Hunt 07 — SecurityEvent 4688 fallback for BlackX installation

Signal: High for exact command

SecurityEvent
| where TimeGenerated >= ago(90d)
| where EventID == 4688
| extend Cmd=tolower(tostring(column_ifexists("CommandLine",""))), Proc=tolower(tostring(column_ifexists("NewProcessName","")))
| where (Proc endswith "\\inst.exe" and Cmd contains "pvmdijgkax2") or Cmd contains "q46f6mdli3rx2kv1"
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName=tostring(column_ifexists("ParentProcessName",""))
| order by TimeGenerated desc

Detection caveat: Requires 4688 process creation with command-line audit enabled and forwarded; no detection if command line omitted.

Hunt 08 — Network perimeter contact with BlackX C2 domain

Signal: High with domain logging

CommonSecurityLog
| where TimeGenerated >= ago(90d)
| extend H=tolower(tostring(column_ifexists("DestinationHostName",""))), U=tolower(tostring(column_ifexists("RequestURL","")))
| where H endswith "archivetj.com" or U contains "archivetj.com"
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationHostName, RequestURL, DeviceAction
| order by TimeGenerated desc

Detection caveat: Requires DNS/HTTP hostname in CEF. Generic encrypted cloud storage connections are not sufficient attribution.

Detection Notes

Highest signal: exact PVMDIJGKAX2 installer artifacts and reported plugin C2. EFI partition commands and nonstandard googleupdate.exe locations are contextual, not proof of BlackX. Cloud services (Google Drive, OneDrive, Yandex.Disk) are legitimate and must not be blocked or treated as BlackX IOCs solely by domain. An EDR process or file hit does not prove firmware compromise, and no hits do not validate the Secure Boot revocation. Event 4688 requires command-line capture. Driver-signer serial is not reliably in these standard tables; do not invent a signer field.