Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.
The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report published this week.
The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.
Notably, BlackX is assessed to be an updated version of BlackLotus, a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023.
BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts. However, successful exploitation hinges on an attacker having administrator privileges or physical access to a target host.
"It is critical to note that a threat actor's use of this bootkit is primarily a persistence and defense evasion mechanism," Microsoft noted at the time. "It is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access."
That said, completely addressing the threat requires additional actions beyond installing the latest update, including running manual steps to apply Microsoft's Secure Boot revocation mitigations, such as adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX).
The Russian cybersecurity company has found that attackers are capitalizing on the fact that organizations have not carried out these manual steps, enabling them to still use the Baton Drop vulnerability even on systems that have the "patch" applied.
"On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted," researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov said.
"It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."
Attackers have been observed deploying BlackX after breaching victim networks through an unspecified method and gaining administrator privileges. To install the bootkit, the threat actor drops the following files -
- inst.exe, an installer executable
- PVMDIJGKAX2, an encrypted extensionless file containing files and strings required for the installation
The installer is then launched via the command line as "C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1," where "Q46F6MDLI3RX2KV1" is the RC4 key used for decryption.
The binary then drops additional files to both system and UEFI partitions to exploit CVE-2022-21894 in a manner that's "remarkably similar" to the one used in BlackLotus. The end goal remains the same: install Machine Owner Keys (MOK) to load arbitrary EFI files on the infected hosts and interfere with Secure Boot.
What's interesting here is that the source code of BlackLotus has never entered the public domain, indicating that the threat actors behind BlackX either reverse-engineered the original bootkit or purchased its source code from another party.
"Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors," Kaspersky said.
The UEFI payload delivered following the exploitation of the vulnerability is engineered to inject a malicious driver into the Windows kernel. The driver has been signed with a certificate belonging to a company named Wenjiang District Mingyu Network Technology Service Studio. The certificate has since been revoked by the issuer.
Like in the case of the bring your own vulnerable driver (BYOVD) attack, the driver attempts to tamper with the functioning of endpoint security software installed on the machine. In an interesting twist, some of the unauthorized modifications are allowed to run only if security programs associated with Kaspersky or Avast are present. However, Kaspersky's analysis has found these routines to be ineffective.
Not just content with trying to render security solutions ineffective, the driver also drops a user-mode payload for cyber espionage. Two such payloads have been observed -
- A remote access trojan that can deliver additional .NET payloads, while using Google Drive, OneDrive, and Yandex.Disk for command-and-control (C2) to blend in with regular enterprise workflows. It's also equipped to harvest system information and upload files of interest.
- A malicious DLL dubbed OxiDLLRunner that's sideloaded by the legitimate "googleupdate.exe" binary, which is also delivered by the bootkit. The DLL decrypts and launches a Rust payload that communicates with "archivetj[.]com" to receive and execute more DLL plugins.
BlackX's connections to APT41 stem from an ESET report in June 2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca, is assessed to be operating under the APT41 umbrella.
The Slovakian cybersecurity company said it also found "limited indications" that some versions of the backdoor may feature a UEFI bootkit component likely exploiting CVE‑2023‑24932, another security feature bypass vulnerability linked to BlackLotus.
An interesting overlap is the presence of the "xdd" string in BlackX and the kernel implant used by FishMonger, raising the possibility that the UEFI bootkit used in those attacks is none other than BlackX. The second clue that points to China-aligned hackers is the use of DLL sideloading to deploy the payloads – a pattern that's extremely common among threat actors of Chinese origin.
"By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes," Kucherin said. "This hybrid approach proves that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks."