Diplomatic entities across Tajikistan, Uzbekistan, and Turkmenistan have fallen victim to a novel **Unified Extensible Firmware Interface (UEFI)** bootkit named **BlackX**. This activity, observed in early 2026, is attributed by **Kaspersky** researchers to **APT41**, a prominent China-linked state-sponsored hacking group. ### The Objective: Evasion and Persistent Access The primary goal of **BlackX** is to subvert **Microsoft Windows** startup defenses and circumvent third-party security solutions, ensuring long-term, stealthy access to compromised systems. Intriguingly, **BlackX** appears to be an evolved variant of **BlackLotus**, a notorious bootkit first seen advertised on cybercrime forums in late 2022 and later confirmed by **ESET** in March 2023. ### Exploiting a Known Vulnerability: **CVE-2022-21894** **BlackLotus** was designed to exploit **CVE-2022-21894** (**CVSS** score: 4.4), also known as Baton Drop, a **Secure Boot** bypass vulnerability. This flaw allows malicious code to load before the operating system initializes. However, successful exploitation necessitates an attacker having administrator privileges or physical access to the target host. **Microsoft** previously stated that this bootkit primarily serves as a persistence and defense evasion mechanism, not an initial access vector. It can only be deployed after an attacker has already gained privileged or physical access. ### The Persistence of an Unpatched Flaw Crucially, fully addressing the **Baton Drop** vulnerability requires more than just installing the latest updates. Manual steps, such as applying **Microsoft's Secure Boot** revocation mitigations and adding the "Windows Production PCA 2011" certificate to the **Secure Boot UEFI Forbidden List (DBX)**, are essential. **Kaspersky** has found that many organizations have not completed these manual steps, allowing attackers to continue exploiting the vulnerability even on systems where the initial patch has been applied. Researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov noted, "It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how **BlackLotus** works and creating a copycat of this bootkit." ### **BlackX** Deployment Mechanics Attackers deploy **BlackX** after gaining administrator privileges on victim networks through unspecified initial access methods. The installation process involves dropping two files: * `inst.exe`: The installer executable. * `PVMDIJGKAX2`: An encrypted, extensionless file containing necessary installation components. The installer is then executed via the command line, leveraging an **RC4** key for decryption. The binary subsequently drops additional files to both system and **UEFI** partitions, exploiting **CVE-2022-21894** in a manner "remarkably similar" to **BlackLotus**. The ultimate goal is to install **Machine Owner Keys (MOK)**, enabling the loading of arbitrary **EFI** files and interfering with **Secure Boot**. ### Code Borrowing: An Unusual APT Tactic Significantly, the complete source code for **BlackLotus** has never been publicly released. This suggests that the threat actors behind **BlackX** either reverse-engineered the original bootkit or acquired its source code. **Kaspersky** highlights this as an unusual observation, as **APT** actors rarely borrow ideas or code from cybercrime groups. ### Kernel Injection and Anti-Security Measures The **UEFI** payload, delivered post-exploitation, injects a malicious driver into the **Windows** kernel. This driver was signed with a certificate belonging to "Wenjiang District Mingyu Network Technology Service Studio," which has since been revoked. Similar to **Bring Your Own Vulnerable Driver (BYOVD)** attacks, this driver attempts to tamper with endpoint security software. Interestingly, some unauthorized modifications are only triggered if **Kaspersky** or **Avast** security programs are detected, though **Kaspersky's** analysis found these routines to be ineffective. ### Espionage Payloads and C2 Beyond disabling security, the driver deploys user-mode payloads for cyber espionage. Two distinct payloads have been observed: * A **Remote Access Trojan (RAT)** capable of delivering additional **.NET** payloads. It utilizes **Google Drive**, **OneDrive**, and **Yandex.Disk** for **command-and-control (C2)**, blending in with legitimate enterprise workflows, and is equipped to harvest system information and upload files. * A malicious **DLL** dubbed **OxiDLLRunner**, which is sideloaded by the legitimate "googleupdate.exe" binary (also delivered by the bootkit). This **DLL** decrypts and launches a **Rust** payload that communicates with "archivetj[.]com" to receive and execute more **DLL** plugins. ### **APT41** Connection The link between **BlackX** and **APT41** is supported by an **ESET** report from June 2026, which detailed **FishMonger's** use of the **SprySOCKS** Windows backdoor in attacks against government entities. **FishMonger**, also known as **Aquatic Panda** and **Earth Lusca**, is considered to operate under the **APT41** umbrella. **ESET** found "limited indications" that some **SprySOCKS** versions might feature a **UEFI** bootkit component, potentially exploiting **CVE-2023-24932**. This vulnerability represents a downgrade attack, where a privileged attacker can force the operating system to boot with an older, legitimately signed **Windows Boot Manager**, reintroducing **CVE-2022-21894**. Further evidence includes the presence of the "xdd" string in both **BlackX** and the kernel implant used by **FishMonger**, suggesting that **BlackX** could be the **UEFI** bootkit in question. The use of **DLL** sideloading to deploy payloads is also a common tactic among China-aligned threat actors. Kucherin concluded, "By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes. This hybrid approach proves that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks."