BlackX Bootkit Revives BlackLotus Tactics — Why Secure Boot Isn’t Enough
Hackers have resurfaced techniques associated with the BlackLotus bootkit in a new implant named BlackX, using a boot‑level exploitation chain to bypass Windows Secure Boot and deploy espionage malware against diplomatic organizations in Central Asia. The campaign, observed in early 2026, targeted agencies in Tajikistan, Uzbekistan, and Turkmenistan. Researchers tied the campaign to APT41 with medium confidence and highlighted a protection gap: affected machines were fully patched, yet vulnerable boot…
