BlackX UEFI bootkit targets Central Asian diplomatic groups

Kaspersky suspects the China-linked state-sponsored hacking group APT41 orchestrated a campaign using the BlackX UEFI bootkit. The malware targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. BlackX is an updated version of the BlackLotus bootkit, which was first advertised on cybercrime forums in late 2022 and confirmed by ESET in March 2023.

The bootkit exploits the Baton Drop vulnerability, identified as CVE-2022-21894, to load malicious code before the operating system starts. Successful exploitation requires an attacker to have administrator privileges or physical access to the target host. BlackX remains effective on patched Windows systems because Secure Boot revocation mitigations require manual steps that organizations often fail to perform. The installer is launched via a command line that includes the RC4 key Q46F6MDLI3RX2KV1 for decryption.

BlackX installs Machine Owner Keys to load arbitrary EFI files and interfere with Secure Boot. The driver attempts to tamper with endpoint security software, including routines that run only if Kaspersky or Avast products are present. It deploys a remote access trojan that uses Google Drive, OneDrive, and Yandex.Disk for command-and-control communication. A malicious DLL named OxiDLLRunner is sideloaded by the legitimate googleupdate.exe binary. This payload decrypts and launches a Rust payload that communicates with archivetj[.]com to receive and execute more DLL plugins. BlackX protects its files by intercepting user requests to open them and launching the Windows Calculator instead.

APT41 is also known by the aliases Brass Typhoon, Wicked Panda, and Barium.