Diplomatic organizations operating across Central Asia have become the targets of a sophisticated cyber-espionage campaign utilizing a newly uncovered Unified Extensible Firmware Interface (UEFI) bootkit known as BlackX. According to a technical report published this week by Kaspersky, the malicious activity singled out diplomatic entities located in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Security researchers suspect that the campaign is orchestrated by APT41, a prominent, China-linked state-sponsored hacking group.
The primary objective behind the deployment of the BlackX malware is to systematically undermine Microsoft Windows startup defenses alongside various third-party security solutions, allowing the threat actors to maintain long-term, covert access to compromised target devices. Security analysts have determined that BlackX is an updated and modified version of BlackLotus, a notorious UEFI bootkit that first surfaced on cybercrime forums in late 2022 before its existence was officially detailed by cybersecurity firm ESET in March 2023.
BlackLotus gained widespread notoriety for its ability to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894, carrying a CVSS score of 4.4 and commonly referred to as Baton Drop. This vulnerability enables malicious actors to load unsigned code before the operating system even starts up. However, security experts have consistently emphasized that successful exploitation of this flaw hinges on an attacker already possessing high-level administrator privileges or physical access to the target host system.
When BlackLotus first emerged, Microsoft noted in its guidance that a threat actor’s deployment of such a bootkit functions primarily as a persistence and defense evasion mechanism. It is not designed to act as a first-stage payload or an initial access vector, meaning it can only be introduced to a device after the attacker has already breached the network perimeter and secured elevated privileges.
Completely mitigating this class of threat requires organizations to take intensive manual actions that go far beyond merely installing routine security updates. This includes running specific manual steps to apply Microsoft’s Secure Boot revocation mitigations, such as adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List, known as the DBX.
Kaspersky’s recent investigation revealed that the attackers behind the BlackX campaign are heavily capitalizing on the fact that many targeted organizations failed to carry out these necessary manual mitigation steps. Consequently, this oversight has left systems vulnerable to the Baton Drop exploit even though the standard operating system patches had ostensibly been applied.
Researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov pointed out that although this specific certificate expired in October 2026, the expiration does not automatically prevent vulnerable binaries from loading unless the certificate is explicitly blocklisted by administrators. They noted that the threat actors behind this regional campaign likely understood that few organizations realized the critical importance of manually activating the Baton Drop patch, prompting them to invest significant time and resources into analyzing how BlackLotus functions and developing their own customized copycat bootkit.
In this ongoing Central Asian campaign, attackers deploy BlackX only after successfully breaching victim networks through initial access methods and securing administrator rights. To install the bootkit, the threat actor introduces specific malicious binaries onto the host system and launches the installer via the command line, utilizing an RC4 key to decrypt the payload during execution.
Following this initialization, the binary drops additional files into both the standard system and UEFI partitions, exploiting CVE-2022-21894 in a manner that security researchers describe as remarkably similar to the techniques utilized by BlackLotus. The ultimate technical goal remains consistent: installing Machine Owner Keys to enable the loading of arbitrary EFI files on infected host machines and thoroughly interfering with normal Secure Boot operations.
What makes the BlackX campaign particularly notable to the cybersecurity research community is the origin of its codebase. Because the source code of the original BlackLotus bootkit was never publicly released or leaked into the open-source domain, the deployment of BlackX strongly indicates that the threat actors either successfully reverse-engineered the original bootkit from scratch or acquired its proprietary source code through underground cybercrime channels. Security analysts observe that it is relatively rare for advanced persistent threat actors to borrow operational concepts or code from financially motivated cybercriminal syndicates, making this hybrid approach a noteworthy development in modern threat intelligence.
The UEFI payload delivered in the wake of the vulnerability exploitation is engineered to inject a malicious driver directly into the Windows kernel. Analysis of this driver revealed that it was signed using a digital certificate belonging to a commercial entity named Wenjiang District Mingyu Network Technology Service Studio, a certificate that has since been revoked by the issuing authority.
Operating similarly to traditional "bring your own vulnerable driver" or BYOVD attacks, the malicious driver attempts to tamper with the core functionalities of endpoint security software installed on the compromised workstation. In a curious operational twist, certain unauthorized modifications introduced by the driver are programmed to execute only if security programs associated with Kaspersky or Avast are detected on the machine. Subsequent analysis by Kaspersky researchers, however, determined that these specific interference routines were ultimately ineffective.
Beyond trying to neutralize local security tools, the kernel driver also drops a dedicated user-mode payload designed explicitly for cyber-espionage activities. The overarching connection between BlackX and the broader APT41 ecosystem was reinforced by an earlier ESET report published in June 2026, which documented how a related threat cluster known as FishMonger utilized a Windows backdoor called SprySOCKS to target government entities across Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, which is also tracked by various security investigators under names such as Aquatic Panda and Earth Lusca, is widely assessed to operate within the broader APT41 operational umbrella.
Slovakian cybersecurity researchers also uncovered limited indications suggesting that certain iterations of the SprySOCKS backdoor may incorporate a UEFI bootkit component that likely exploits another security feature bypass vulnerability, CVE-2023-24932, which is similarly associated with the evolution of BlackLotus. Another telling technical overlap identified by investigators is the recurring presence of the "xdd" string within both the BlackX binaries and the kernel implants utilized by FishMonger, strongly supporting the assessment that the UEFI bootkit observed in those regional attacks is indeed BlackX.
A secondary clue pointing toward a China-aligned threat nexus is the heavy reliance on DLL sideloading techniques to deploy the operational payloads—a methodology that remains exceptionally common among threat groups originating from or operating in the region.
Security analysts emphasize that by adapting commercial crimeware tools and sophisticated bootkits to suit their strategic espionage objectives, state-sponsored adversaries are able to bypass traditional safeguards meant to protect the Windows boot process. This hybrid methodology demonstrates that highly capable threat actors continue to leverage innovative shortcuts to establish persistent, stealthy control over high-value diplomatic and governmental networks without needing to develop every component of their toolkits from the ground up.
