Something’s off.Trying to open BlackX’s own files reportedly launches Windows Calculator instead. Kaspersky researchers describe this as a file-protection feature of the malware’s malicious driver, which intercepts users’ requests to open those files.
BlackX is described as a UEFI bootkit: malware that operates through the computer’s startup process. The researchers say it exploits the older Baton Drop vulnerability to bypass Secure Boot, a startup security protection, and load the driver. The Calculator behavior concerns the bootkit’s files on compromised machines—not ordinary file-opening requests across Windows.
The researchers also report that all BlackX victims were running fully patched Windows releases. They attribute the successful bypass to an additional protection step that administrators had not manually activated: revoking the certificate used to sign vulnerable startup components. In their account, installing the update alone did not activate that revocation.
UNVERIFIED
A report was identified through its feed entry; the underlying claims have not been independently verified.
UNVERIFIED — Discovered through BleepingComputer’s feed, with article text supplied. The reported behavior and researchers’ explanations have not been independently verified. Source report
