SecurityThe Hacker Newsabout 2 hours ago
APT41 Bootkit Bypasses Patched Windows Secure Boot
5 min read
China-linked group APT41 deployed BlackX bootkit targeting diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The malware bypasses Microsoft Windows Secure Boot by exploiting CVE-2022-21894, which was patched on October 19, 2026, when its certificate expired. Researchers found attackers used manual revocation steps that organizations failed to apply, allowing the threat to persist despite system updates.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
