BlackX bootkit reuses BlackLotus installer flow on unrevoked CVE-2022-21894 binaries after October 2026 PCA expiry
BlackX demonstrates that unapplied revocation lists, not new exploits, keep CVE-2022-21894 viable against targeted diplomatic networks. The bootkit copies BlackLotus mechanics without public code, pointing to direct knowledge transfer. Manual DBX updates remain the decisive control that most victims have not performed.
Operational impact centers on long-term stealth on air-gapped or high-security hosts where firmware updates lag. Next indicators will appear in EFI partition hashes and unexpected MOK enrollments logged by endpoint firmware. Organizations that still lack the DBX revocation will remain exposed until hardware-level Secure Boot databases are rebuilt or replaced.
Kaspersky: BlackX or direct forks will appear in at least two additional regions with unrevoked DBX by March 2027
Sources (2)
- [1]Primary Source(https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html)
- [2]Supporting Source(https://securelist.com/blacklotus-uefi-bootkit/109362/)