BlackX Bootkit Targets Central Asian Diplomats, Linked to APT41
A sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX has been identified as targeting diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. This activity is believed to be orchestrated by the China-linked state-sponsored hacking group known as APT41, according to a technical report published by Kaspersky.
The primary goal of BlackX is to undermine Microsoft Windows startup defenses and third-party security solutions, allowing for long-term covert access to compromised devices. BlackX is considered an updated version of BlackLotus, a notorious bootkit first advertised on cybercrime forums in late 2022 and confirmed by ESET in March 2023.
BlackLotus exploits a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts. Successful exploitation requires an attacker to have administrator privileges or physical access to the target device.
Microsoft noted that the use of this bootkit is primarily for persistence and defense evasion, stating, “It is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access.” Addressing the threat involves more than just installing updates; it requires manual steps to apply Microsoft’s Secure Boot revocation mitigations.
Kaspersky’s research indicates that attackers are exploiting the fact that many organizations have not completed these manual steps, allowing them to utilize the Baton Drop vulnerability even on systems with the patch applied. Researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov pointed out that the certificate associated with this vulnerability expired on October 19, 2026, but vulnerable binaries can still load unless blocklisted.
Attackers have been observed deploying BlackX after breaching victim networks and gaining administrator privileges. The installation process involves dropping files such as inst.exe, an installer executable, and PVMDIJGKAX2, an encrypted file necessary for installation. The installer is executed via the command line with a specific RC4 key for decryption.
Once installed, BlackX drops additional files to both system and UEFI partitions to exploit CVE-2022-21894 in a manner similar to BlackLotus. The ultimate aim is to install Machine Owner Keys (MOK) to load arbitrary EFI files on infected hosts and disrupt Secure Boot.
Interestingly, the source code for BlackLotus has never been publicly available, suggesting that the creators of BlackX either reverse-engineered it or acquired the code from another source. Kaspersky remarked on the rarity of APT actors borrowing from cybercrime groups.
The UEFI payload delivered through this vulnerability is designed to inject a malicious driver into the Windows kernel. This driver, signed with a certificate from Wenjiang District Mingyu Network Technology Service Studio, has since been revoked. The driver attempts to interfere with the functionality of endpoint security software, particularly those associated with Kaspersky or Avast, although Kaspersky’s analysis found these attempts to be ineffective.
In addition to disrupting security solutions, the driver also deploys a user-mode payload for cyber espionage. Two payloads have been identified: a remote access trojan capable of delivering additional .NET payloads and a malicious DLL named OxiDLLRunner, which is sideloaded by the legitimate googleupdate.exe binary.
BlackX’s connections to APT41 were highlighted in an ESET report from June 2026, which documented the use of a Windows backdoor called SprySOCKS in attacks against government entities in several countries. The overlap of certain strings in BlackX and the kernel implant used by FishMonger raises the possibility that the UEFI bootkit in those attacks may be BlackX.
Kaspersky concluded that by adapting a commercial crimeware tool, APT41 could bypass protections intended to secure Windows boot processes, demonstrating that sophisticated adversaries can leverage existing tools to maintain control over high-value networks.
Source: The Hacker News