Diplomatic organizations operating across Central Asia have become the primary focus of a highly sophisticated cyber espionage campaign making use of a newly identified Unified Extensible Firmware Interface (UEFI) bootkit designated as BlackX.
According to a technical report published this week by researchers at Kaspersky, the malicious activity singled out diplomatic entities located in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Investigators strongly suspect the campaign is orchestrated by a China-linked state-sponsored threat group known as APT41, marking a significant convergence of high-level espionage tactics and advanced low-level firmware manipulation.
The principal objective behind deploying the BlackX malware is to systematically undermine Microsoft Windows startup defenses alongside third-party security solutions, allowing the threat actors to maintain long-term, covert access to compromised systems. By targeting the system’s firmware level, the operators aim to establish persistence that survives operating system re-installations and evades traditional endpoint detection mechanisms.
Cybersecurity analysts have assessed that BlackX serves as an updated and adapted variant of BlackLotus, a notorious UEFI bootkit that first surfaced on cybercrime forums in late 2022 before its existence was officially confirmed by researchers at ESET in March 2023.
The original BlackLotus framework was engineered to exploit a critical, patchable Secure Boot bypass vulnerability tracked as CVE-2022-21894, which carries a CVSS severity score of 4.4 and is commonly referred to as Baton Drop. This vulnerability allows attackers to load malicious code into execution before the operating system kernel fully initializes. However, successful exploitation has historically depended on an attacker already acquiring administrator-level privileges or physical access to the targeted host machine.
Security experts note that the deployment of such advanced bootkits is fundamentally a persistence and defense evasion technique rather than an initial access vector.
As Microsoft emphasized during initial analyses of related campaigns, the bootkit cannot be used to break into a network from the outside; it can only be introduced to a device after the threat actor has successfully gained either privileged credentials or physical control over the hardware. Consequently, completely mitigating the underlying risk requires extensive administrative actions that go far beyond standard operating system updates.
These necessary measures include performing manual steps to apply Microsoft’s Secure Boot revocation mitigations, such as explicitly adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List, commonly known as the DBX.
Kaspersky’s recent investigation revealed that threat actors are actively capitalizing on the widespread oversight among organizations that have failed to execute these manual updates. Because many entities left the database unconfigured, attackers are still able to leverage the Baton Drop vulnerability even on modern systems that have nominally applied the standard operating system patches.
Researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov noted that while the relevant certificate officially expired, vulnerable binaries continue to load successfully unless the certificate is explicitly blocklisted by system administrators.
The investigators concluded that the threat actors behind the BlackX campaign likely recognized that few organizations understood the critical importance of manually activating the Baton Drop patch. This oversight evidently presented an opportunity, prompting the group to invest substantial time into understanding how BlackLotus operates and developing their own functional copycat of the bootkit.
In observed attacks, threat actors deploy BlackX only after breaching victim networks through initial access vectors and subsequently escalating their privileges to obtain administrator status. To install the bootkit, operators introduce specific payload files and launch the installer through the command line interface using designated configuration keys, including an RC4 key utilized for decryption purposes.
Once initiated, the binary drops supplementary files into both standard system partitions and UEFI system partitions to exploit CVE-2022-21894 in a manner remarkably similar to the techniques observed in original BlackLotus deployments. The ultimate technical goal remains focused on installing Machine Owner Keys to enable the loading of arbitrary EFI files on infected hosts while severely interfering with normal Secure Boot operations.
A particularly noteworthy aspect of this campaign is that the complete source code of BlackLotus has never entered the public domain. This reality indicates that the operators behind BlackX either successfully reverse-engineered the original commercial bootkit or procured its source code through illicit underground channels. Security researchers have highlighted this development as an intriguing observation, noting that advanced persistent threat groups rarely borrow concepts or core code from cybercrime syndicates.
The low-level UEFI payload delivered during the exploitation phase is designed to inject a malicious driver directly into the Windows kernel. This specific driver has been observed signed with a digital certificate belonging to a commercial entity named Wenjiang District Mingyu Network Technology Service Studio, though the issuing authority has since revoked the certificate.
Operating in a fashion reminiscent of Bring Your Own Vulnerable Driver attacks, the malicious driver attempts to actively disrupt the normal functioning of endpoint security software installed on the compromised machine. In a peculiar twist noted by researchers, certain unauthorized modifications are programmed to execute exclusively if specific security solutions associated with Kaspersky or Avast are detected on the host, though subsequent analysis confirmed that these specific routines were largely ineffective.
Beyond seeking to neutralize competing security controls, the driver is also configured to deploy a user-mode payload tailored specifically for cyber espionage operations. Connections between BlackX and the broader APT41 ecosystem were further solidified following an independent report published by ESET, which documented related threat activity utilizing a Windows backdoor known as SprySOCKS against government entities across Honduras, Taiwan, Thailand, and Pakistan.
The security firm behind that report also identified limited indications that certain iterations of the backdoor may incorporate a UEFI bootkit component likely targeting CVE-2023-24932, another prominent security feature bypass vulnerability associated with the BlackLotus lineage.
Further reinforcing the attribution are distinct technical overlaps, including the presence of specific internal string markers shared between BlackX and kernel implants used in related campaigns, as well as the reliance on DLL sideloading techniques to deploy user-mode payloads—a methodology heavily favored by China-aligned threat actors.
Security researchers emphasize that by adapting commercial crimeware tools and methodologies, sophisticated actors can effectively bypass complex procedures originally designed to protect the integrity of Windows boot processes. This hybrid approach demonstrates that advanced adversaries can leverage existing criminal ecosystems to establish persistent, stealthy control over high-value organizational networks without needing to reinvent complex foundational capabilities.
