BlackX UEFI Bootkit Targets Central Asia
- Fully patched Windows systems remain vulnerable to a sophisticated UEFI bootkit called BlackX.
- The BlackX espionage campaign struck diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026.
- Kaspersky researchers analyzed the malware and linked it with medium confidence to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium.
Fully patched Windows systems remain vulnerable to a sophisticated UEFI bootkit called BlackX. Security researchers discovered that attackers are exploiting an old flaw because system administrators rarely take manual action after installing security updates.
Diplomatic Agencies in Central Asia Targeted by BlackX
The BlackX espionage campaign struck diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026.
Kaspersky researchers analyzed the malware and linked it with medium confidence to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium. Osintsights.com noted that the actors dropped an installer executable named inst.exe alongside an RC4-encrypted, extensionless file designated as PVMDIJGKAX2.
Baton Drop Exploitation Mirrors BlackLotus Codebase
The BlackX bootkit targets CVE-2022-21894, a vulnerability known as Baton Drop that bypasses Secure Boot protections. Securelist.com detailed how the original BlackLotus bootkit first emerged on hacking forums in October 2022 and was confirmed by ESET in March 2023.
APT41-linked BlackX UEFI bootkit targets Central Asian-linked espionage campaign, exploiting a 2022 Secure Boot flaw still viable on patched systems that skipped manual revocation steps.Key findings:- BlackX is an evolved version of BlackLotus, exploiting CVE-2022-21894 (CVSS… pic.twitter.com/FWTP1pla6Y
Kaspersky found that BlackX implements the exploit in a way that is remarkably similar to BlackLotus. This mechanism allows attackers to enroll custom Machine Owner Keys and load arbitrary extensible firmware interface files. Because the source code leaked in July 2023 was incomplete, researchers concluded that the BlackX operator either reverse-engineered BlackLotus or purchased its source code directly.
Kernel Tampering and Cloud-Based Command Channels
Once active, the BlackX UEFI payload injects a malicious Windows kernel driver signed with a certificate issued to Wenjiang District Mingyu Network Technology Service Studio. Securelist.com confirmed that the issuing authority has since revoked this certificate.
The driver disables process, thread, and registry callbacks tied to security solutions while tampering with Event Tracing for Windows providers. Osintsights.com reported that BlackX deploys a remote access trojan leveraging Google Drive, OneDrive, and Yandex.Disk for command-and-control operations alongside a sideloaded DLL named OxiDLLRunner that executes Rust payloads.
Manual Mitigation Gaps Undermine Microsoft Patches
Every victim identified in the BlackX campaign operated a fully patched Windows release. The attack succeeded because administrators failed to manually activate additional Secure Boot revocations after applying the software updates.
Kaspersky explained that the patch for Baton Drop revokes the Windows Production PCA 2011 certificate, but this revocation does not trigger automatically. Researchers warned that administrators almost never take manual action after a patch installation, leaving a critical mitigation gap that threat actors actively exploit.