Diplomatic organizations across Central Asia have found themselves in the crosshairs of a sophisticated new cyber espionage campaign leveraging an advanced Unified Extensible Firmware Interface (UEFI) bootkit known as BlackX. According to a technical report published this week by Kaspersky, the malicious activity singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Security researchers strongly suspect that the operation is orchestrated by a prominent China-linked state-sponsored threat group widely tracked as APT41.
The primary objective behind deploying the BlackX malware is to systematically undermine Microsoft Windows startup defenses alongside various third-party security solutions, allowing the attackers to maintain long-term, covert access to compromised target devices. Security analysts have determined that BlackX is an updated and modified version of BlackLotus, a notorious and powerful bootkit that first surfaced on cybercrime forums in late 2022 before its existence was officially confirmed and detailed by ESET in March 2023.
BlackLotus was originally engineered to exploit a patchable Secure Boot bypass vulnerability tracked as CVE-2022-21894, which carries a CVSS score of 4.4 and is frequently referred to as "Baton Drop." This vulnerability enables malicious actors to load unauthorized code before the operating system even begins to boot. However, security researchers have long emphasized that successful exploitation of this flaw is not a trivial matter; it hinges fundamentally on an attacker already possessing administrator privileges or physical access to the targeted host machine.
When the original BlackLotus campaign came to light, Microsoft issued detailed guidance emphasizing that a threat actor’s deployment of such a bootkit functions primarily as a persistence and defense evasion mechanism. It is never utilized as a first-stage payload or an initial access vector. Instead, it can only be successfully introduced to a device to which an attacker has already secured privileged or physical entry.
Addressing this threat completely, however, requires far more than merely installing standard monthly operating system updates. Mitigating the vulnerability necessitates running specific manual procedures to apply Microsoft’s Secure Boot revocation mitigations. These required steps include adding the "Windows Production PCA 2011" certificate directly to the Secure Boot UEFI Forbidden List, commonly known as the DBX.
Kaspersky’s recent investigation revealed that attackers are actively capitalizing on the widespread oversight that many organizations have failed to carry out these manual steps. Because the necessary administrative blocklisting has often been neglected, threat actors remain fully capable of exploiting the Baton Drop vulnerability even on systems that have supposedly been patched via standard update channels.
As researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov pointed out in their technical report, the relevant certificate officially expired in October 2026, yet this expiration does not prevent vulnerable binaries from loading unless the certificate is explicitly blocklisted. Consequently, the threat actors behind this targeted Central Asian campaign recognized that few organizations realized the operational importance of manually activating the Baton Drop patch. This oversight provided the opening for the adversaries to invest time in thoroughly understanding how BlackLotus operates and engineering their own customized copycat bootkit.
In observed attacks, threat actors deploy BlackX after successfully breaching victim networks through an unspecified initial vector and escalating privileges to gain administrator access. To execute the installation of the bootkit, the adversary drops a specific set of files onto the host system. The malicious installer is subsequently launched via the command line as an executable utilizing a specific RC4 key for decryption purposes.
The binary then drops additional files into both standard system and UEFI partitions to exploit CVE-2022-21894 in a manner that researchers describe as remarkably similar to the techniques observed in historical BlackLotus campaigns. The ultimate strategic goal remains consistent: install Machine Owner Keys to load arbitrary Extensible Firmware Interface files on infected hosts and directly interfere with the normal operations of Secure Boot.
What makes this development particularly fascinating to the cybersecurity research community is that the source code of BlackLotus has never entered the public domain. This reality indicates that the operators behind BlackX either successfully reverse-engineered the original commercial bootkit from scratch or managed to purchase its exclusive source code from an external underground party.
Kaspersky researchers noted that this represents a rare and notable observation, as advanced persistent threat actors rarely borrow ideas, methodologies, or operational code from traditional cybercrime syndicates. By adapting a commercial crimeware tool, the group behind BlackX successfully bypassed the foundational security procedures intended by operating system manufacturers to protect the Windows boot process. This hybrid approach demonstrates that sophisticated state-sponsored adversaries do not always need to reinvent the wheel when seeking to establish persistent, invisible control over high-value government networks.
The UEFI payload delivered following the successful exploitation of the vulnerability is meticulously engineered to inject a malicious driver directly into the Windows kernel. Analysis revealed that this particular driver was signed using a digital certificate belonging to a commercial entity named Wenjiang District Mingyu Network Technology Service Studio. Predictably, the issuing authority has since revoked the compromised certificate.
Mirroring the tactics seen in "Bring Your Own Vulnerable Driver" attacks, the injected driver attempts to actively tamper with the normal functioning of endpoint security software installed on the compromised machine. In a peculiar twist, researchers observed that some of these unauthorized tampering routines are programmed to execute only if security programs associated with Kaspersky or Avast are actively detected on the host. However, Kaspersky’s deep analysis determined that these specific routines were ultimately ineffective in disabling their targeted defenses.
Beyond attempting to render security solutions inoperative, the malicious driver also drops a user-mode payload specifically designed for cyber espionage activities. Connections linking BlackX directly to APT41 stem from broader intelligence gathered earlier in the year. In June 2026, ESET documented an affiliated cluster known as FishMonger utilizing a Windows backdoor called SprySOCKS during attacks targeting government agencies across Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, which is also tracked under aliases such as Aquatic Panda and Earth Lusca, is assessed by threat intelligence analysts to operate firmly within the broader APT41 ecosystem.
Furthermore, researchers identified limited technical indications suggesting that certain versions of this backdoor may incorporate a UEFI bootkit component likely exploiting CVE-2023-24932, another prominent security feature bypass vulnerability historically linked to the BlackLotus lineage. A compelling technical overlap reinforcing this attribution is the presence of the string "xdd" in both BlackX and the kernel implant utilized by FishMonger, raising the distinct possibility that the UEFI bootkit deployed in those earlier operations is identical to BlackX. An additional clue pointing toward China-aligned threat actors is the heavy reliance on DLL sideloading to deploy payloads, an operational pattern that remains extremely common among state-sponsored groups originating from the region.
