A newly reported UEFI bootkit known as BlackX has drawn attention to a security weakness that can persist even on patched Windows devices: systems may still be exposed if Secure Boot revocation updates are missing. According to a technical report cited by The Hacker News, Kaspersky linked the activity to attacks against diplomatic organisations in Central Asia and said the campaign is suspected to be associated with the China-linked threat group APT41.

While the reported targets were diplomatic entities rather than commercial organisations, the techniques described are relevant for European businesses because they focus on the pre-boot environment, where attackers can gain persistence below the operating system. That makes detection and remediation significantly harder than for ordinary malware.

What happened

The report describes a UEFI bootkit, a type of malware designed to compromise the firmware layer used to start a computer before Windows loads. In this case, the malware reportedly bypassed Secure Boot on some systems that were otherwise patched, because the devices were missing required revocations.

Secure Boot is intended to stop untrusted boot components from loading during startup. However, that protection depends not only on operating system patches but also on up-to-date trust and revocation data. If known-vulnerable boot components have not been revoked on a device, attackers may still be able to exploit the boot process even when standard Windows updates have been installed.

Kaspersky said the activity affected diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The attribution to APT41 is described as suspected, not confirmed as a legal finding.

Why it matters for European businesses

For many businesses, endpoint security programmes focus heavily on OS patching, antivirus, EDR and user-level threats such as phishing. This case is a reminder that firmware and boot-chain security also matter, especially for organisations handling sensitive data, executive communications, intellectual property or regulated workloads.

A UEFI-level compromise can create several business risks:

• Persistence: malware below the OS can survive some remediation steps and be harder to remove.
• Evasion: pre-boot malware may reduce the effectiveness of security tools that start after the operating system loads.
• Higher incident response costs: investigation may require specialist forensics, hardware-level checks or device replacement.
• Supply and trust concerns: businesses may discover that patch compliance dashboards do not fully reflect boot security status.

For European companies, this is particularly relevant where laptops are widely used by remote staff, senior leadership, travelling employees, or teams working across multiple jurisdictions. It also matters for organisations preparing for tighter cybersecurity governance under frameworks such as NIS2, where asset visibility, risk management and incident preparedness are important.

Who may be affected

The immediate reported victims were diplomatic organisations, but the defensive lessons extend well beyond government.

• Regulated businesses handling sensitive or strategic information.
• SMEs with outsourced IT that assume Windows patching alone covers endpoint security.
• Companies with executive travel exposure or cross-border operations.
• IT teams managing mixed hardware fleets where firmware update processes vary by vendor.
• Managed service providers and digital agencies responsible for endpoint governance on behalf of clients.

Organisations using modern Windows devices are not automatically vulnerable to the specific threat described, but they may still have a security management gap if they do not track firmware updates, Secure Boot state and revocation status consistently across endpoints.

What companies should consider

Based on the reported technique, businesses should review whether endpoint security processes extend beyond routine OS patching.

• Check firmware management: confirm whether device fleets receive BIOS/UEFI and vendor firmware updates through a controlled process.
• Review Secure Boot governance: verify Secure Boot is enabled where appropriate and assess whether revocation-related updates have been applied.
• Validate visibility: make sure asset and endpoint tools can report on hardware model, firmware version and security configuration, not only Windows patch status.
• Test incident response assumptions: ensure procedures cover suspected firmware compromise, including isolation, forensic escalation and potential device replacement.
• Prioritise high-risk users: executives, administrators, travelling staff and teams with access to sensitive systems may warrant stricter device controls.
• Coordinate with vendors and MSPs: ask hardware suppliers or managed security partners how they handle boot-chain protections and revocation updates.

The broader lesson is practical: being fully patched at the operating system level does not always mean a device is fully protected. For European businesses, especially those with limited internal security capacity, this makes endpoint baseline reviews and firmware governance increasingly important.