Diplomatic organizations operating across Central Asia have found themselves the target of a highly sophisticated cyberespionage campaign utilizing a newly identified Unified Extensible Firmware Interface (UEFI) bootkit designated as BlackX. According to a technical report published this week by Kaspersky, the malicious activity specifically singled out diplomatic entities located in Tajikistan, Uzbekistan, and Turkmenistan in the early months of 2026. Security researchers strongly suspect that the operation is being orchestrated by APT41, a well-known, China-linked state-sponsored hacking group notorious for conducting complex, long-term intrusions against high-value international targets.
The primary objective behind the deployment of the BlackX malware is to systematically undermine and subvert Microsoft Windows startup defenses, alongside various third-party security solutions, ensuring that the operators maintain long-term, covert, and persistent access to compromised devices. Security analysts have determined that BlackX functions as an updated and adapted iteration of BlackLotus, a highly dangerous bootkit that first surfaced on cybercrime forums in late 2022 before its existence was officially confirmed and detailed by ESET in March 2023.
BlackLotus gained widespread notoriety for its ability to exploit a previously patched Secure Boot bypass vulnerability tracked as CVE-2022-21894, which carries a CVSS score of 4.4 and is frequently referred to in the cybersecurity community as Baton Drop. This exploit allows threat actors to load malicious code into a compromised system before the operating system even begins to boot, effectively bypassing standard OS-level security controls. However, security researchers have consistently emphasized that successful exploitation of this nature hinges on an attacker already having acquired administrative privileges or physical access to the target host.
When the BlackLotus threat first emerged, Microsoft issued extensive guidance noting that a threat actor’s use of such a bootkit serves primarily as a persistence and defense evasion mechanism rather than a first-stage payload or initial access vector. Because it can only be deployed to a device where an attacker has already established privileged or physical access, remediation requires significantly more than just applying standard software updates. Completely addressing the threat mandates additional manual actions, including running specific procedures to apply Microsoft’s Secure Boot revocation mitigations. These crucial steps involve adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List, commonly known as the DBX.
Kaspersky’s recent findings reveal that the threat actors behind the BlackX campaign have heavily capitalized on the widespread oversight of organizations failing to carry out these manual configuration steps. By exploiting this administrative gap, the attackers are able to successfully leverage the Baton Drop vulnerability even on systems that have ostensibly received the standard operating system patches. Researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov noted that while this specific certificate expired in October 2026, the expiration does not prevent vulnerable binaries from loading unless the certificate has been explicitly blocklisted by administrators.
The Kaspersky researchers suggested that the threat actor behind this campaign likely took into account the reality that very few organizations realized the critical importance of manually activating the Baton Drop mitigation. Consequently, the adversaries apparently decided to invest significant time and technical resources into understanding how the original BlackLotus bootkit operates and developing a sophisticated copycat variant tailored to their specific operational requirements.
In observed attacks, threat actors deploy BlackX only after successfully breaching victim networks through initial access vectors that remain unspecified, subsequently elevating their privileges to gain administrative control. To initiate the installation of the bootkit, the threat actor drops a specific set of files onto the host system. The installer binary is then launched via the command line utilizing an execution string that includes an RC4 decryption key. Once executed, the binary drops additional malicious files to both the standard system partitions and the UEFI partitions, successfully exploiting CVE-2022-21894 in a manner that researchers describe as remarkably similar to the techniques utilized by BlackLotus. The ultimate technical goal remains focused on installing Machine Owner Keys to facilitate the loading of arbitrary EFI files on infected hosts and thoroughly interfering with normal Secure Boot operations.
A particularly intriguing aspect of this campaign is that the source code of the original BlackLotus bootkit has never entered the public domain or leaked widely. This indicates that the threat actors behind BlackX either successfully reverse-engineered the original bootkit entirely on their own or acquired its source code through illicit channels from another cybercrime entity. Kaspersky noted that this observation is notably rare in threat intelligence, as advanced persistent threat actors seldom borrow concepts, methodologies, or code directly from traditional cybercrime ecosystems.
The UEFI payload delivered in the wake of the vulnerability exploitation is meticulously engineered to inject a malicious driver directly into the Windows kernel. Forensic analysis revealed that this particular driver was signed using a digital certificate belonging to a commercial entity named Wenjiang District Mingyu Network Technology Service Studio, a certificate that has since been officially revoked by the issuing authority. Operating similarly to a "bring your own vulnerable driver" attack, the malicious driver actively attempts to tamper with the functionality and monitoring capabilities of endpoint security software installed on the machine. In a curious operational twist, certain unauthorized modifications within the driver are programmed to execute only if security programs associated with Kaspersky or Avast are actively detected on the host, though subsequent analysis confirmed that these specific routines proved to be largely ineffective.
Beyond attempting to neutralize security software, the kernel driver also drops a user-mode payload designed specifically for cyber espionage activities. The operational connections linking BlackX directly to APT41 stem partly from a comprehensive ESET report published earlier in the year, which documented the activities of a cluster known as FishMonger. This group utilized a sophisticated Windows backdoor called SprySOCKS in targeted attacks against government entities across Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, which is also tracked by other security firms under names such as Aquatic Panda and Earth Lusca, is widely assessed by the intelligence community to operate under the broader umbrella of the APT41 threat group.
Furthermore, Slovakian cybersecurity researchers identified limited indications suggesting that certain iterations of the SprySOCKS backdoor may incorporate a UEFI bootkit component likely exploiting CVE-2023-24932, which represents yet another security feature bypass vulnerability historically associated with the BlackLotus ecosystem. Additional technical overlaps include the presence of the "xdd" string within both BlackX and the kernel implants utilized by FishMonger, strengthening the assessment that the UEFI bootkit employed in those operations is indeed BlackX. A secondary indicator pointing firmly toward China-aligned threat actors is the heavy reliance on DLL sideloading to deploy payloads, a tradecraft pattern that is exceedingly common among intrusion sets originating from the region.
Summarizing the significance of the campaign, Kucherin pointed out that by successfully adapting a commercial-grade crimeware tool, the threat group was able to bypass the robust protective procedures meant to safeguard standard Windows boot processes. This hybrid operational approach demonstrates conclusively that highly sophisticated adversaries do not always need to reinvent technical methodologies from scratch to establish persistent, stealthy control over high-value diplomatic and governmental networks.
