China-Linked APT41 Targets Central Asian Diplomats with Sophisticated "BlackX" UEFI Bootkit

Diplomatic organizations across Central Asia have found themselves in the crosshairs of a highly sophisticated cyberespionage campaign involving a newly uncovered Unified Extensible Firmware Interface (UEFI) bootkit designated as BlackX. According to a comprehensive technical report published this week by Kaspersky, the malicious activity primarily targeted diplomatic entities located in Tajikistan, Uzbekistan, and Turkmenistan in the early months of 2026. Security researchers strongly suspect that this stealthy operation is being orchestrated by APT41, a notorious, state-sponsored cyberespionage group with deep ties to China.

The primary objective behind the deployment of the BlackX malware is twofold: to systematically dismantle Microsoft Windows startup defenses alongside third-party endpoint security solutions, and to secure long-term, covert access to compromised high-value networks. Investigators have determined that BlackX functions as an updated and heavily modified variant of BlackLotus, a widely publicized bootkit that first surfaced on underground cybercrime forums in late 2022 before cybersecurity firm ESET officially confirmed its existence and operational capabilities in March 2023.

BlackLotus gained global notoriety for its ability to exploit a patched Secure Boot bypass vulnerability tracked as CVE-2022-21894—often referred to in the cybersecurity community as Baton Drop. This vulnerability allows malicious actors to load unsigned code and execute payloads before the host operating system even initializes. However, security analysts have consistently emphasized that successful exploitation of this flaw is not a standalone initial access vector. Instead, it fundamentally relies on an attacker already having acquired administrative privileges or physical access to the target host.

"It is critical to note that a threat actor’s use of this bootkit is primarily a persistence and defense evasion mechanism," Microsoft noted in previous guidance regarding the original BlackLotus campaigns. "It is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access."

Mitigating this class of threat requires far more than simply installing standard monthly operating system updates. Completely addressing vulnerabilities like Baton Drop necessitates manual intervention from system administrators to apply Microsoft’s comprehensive Secure Boot revocation mitigations. This crucial remediation step includes adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List, commonly known as the DBX.

Kaspersky’s research revealed that the threat actors behind the BlackX campaign are actively capitalizing on the widespread oversight of organizations failing to carry out these complex manual procedures. Because many enterprises assume that standard patching is sufficient, attackers are still able to successfully leverage the Baton Drop vulnerability even on systems that have ostensibly received the latest official updates.

"On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted," researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov explained in their technical analysis. "It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."

In observed incidents, attackers deploy BlackX only after successfully breaching victim networks through preliminary, unspecified methods and elevating their privileges to administrator level. To initiate the installation of the bootkit, the threat actor drops specialized installer components onto the host machine. The installer is subsequently launched via the command line utilizing specific operational parameters, including an embedded RC4 decryption key designed to obfuscate the execution flow.

Once launched, the binary proceeds to drop additional malicious files onto both standard system partitions and hidden UEFI partitions. This allows the actors to exploit CVE-2022-21894 in a manner that Kaspersky researchers described as remarkably similar to the techniques pioneered by BlackLotus. The ultimate operational goal remains consistent with the original design: installing Machine Owner Keys to enable the loading of arbitrary, attacker-controlled EFI files on infected hosts while severely crippling the integrity of Secure Boot mechanisms.

What makes the BlackX campaign particularly noteworthy to security analysts is the origin of the code. Because the complete source code of BlackLotus has never been leaked or entered the public domain, cybersecurity experts conclude that the threat actors behind BlackX either dedicated significant resources to reverse-engineering the original commercial bootkit or procured its source code through illicit underground channels.

"Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors," Kaspersky noted in its report.

Following the successful exploitation of the UEFI vulnerability, the delivered payload is engineered to inject a malicious driver directly into the Windows kernel. Intriguingly, this driver was initially signed using a legitimate certificate issued to an entity named Wenjiang District Mingyu Network Technology Service Studio, though the certificate has since been revoked by the issuing authority.

Operating similarly to "Bring Your Own Vulnerable Driver" attacks, this malicious driver attempts to neutralize or disrupt the functionality of endpoint security software installed on the compromised machine. In a peculiar operational quirk, certain unauthorized modifications implemented by the driver are programmed to execute exclusively when security programs associated with Kaspersky or Avast are detected on the host. However, subsequent analysis by Kaspersky confirmed that these particular interference routines were largely ineffective in practice.

Beyond attempting to render local security solutions inert, the driver also facilitates the deployment of user-mode payloads specifically tailored for cyber espionage operations. The operational ties linking BlackX to the broader APT41 ecosystem stem from overlapping intelligence documented by ESET in June 2026. That research detailed how a subgroup known as FishMonger—also tracked under names like Aquatic Panda and Earth Lusca—utilized a Windows backdoor called SprySOCKS to target government entities across Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024.

Furthermore, Slovakian cybersecurity researchers previously identified limited indications suggesting that certain iterations of this backdoor may incorporate a UEFI bootkit component likely designed to exploit CVE-2023-24932, another prominent security feature bypass vulnerability historically associated with the BlackLotus threat family. Another compelling technical overlap is the presence of the exact string "xdd" in both BlackX and the kernel implants utilized by FishMonger, strongly supporting the assessment that the UEFI bootkit observed in those prior operations is identical to BlackX. Additional attribution clues pointing toward China-aligned actors include the heavy reliance on DLL sideloading techniques to deploy payloads, a signature behavioral pattern frequently observed across numerous campaigns originating from Chinese threat groups.

"By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes," Kucherin observed. "This hybrid approach proves that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks."