State-Sponsored Cyber Espionage Campaign Targets Central Asian Diplomats with Sophisticated UEFI Bootkit

Diplomatic organizations operating across Central Asia have become the primary targets of a highly sophisticated and stealthy Unified Extensible Firmware Interface bootkit known as BlackX. According to a technical report published this week by cybersecurity researchers at Kaspersky, the malicious activity specifically singled out high-profile diplomatic entities stationed in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. Investigators suspect that the campaign is being orchestrated by a prominent, China-linked state-sponsored threat group widely tracked as APT41.

The primary objective behind the deployment of the BlackX malware is to systematically undermine critical Microsoft Windows startup defenses, alongside third-party security solutions, while establishing long-term, covert, and persistent access to compromised devices. By operating at the firmware level, the bootkit manages to embed itself deep within the host system, making traditional detection methods significantly more difficult and allowing threat actors to maintain operational control even if standard operating system files are wiped or reinstalled.

Security analysts have determined that BlackX represents an updated, adapted iteration of BlackLotus, a notorious UEFI bootkit that first surfaced on cybercrime forums in late 2022 before its existence was officially analyzed and confirmed by ESET researchers in March 2023. BlackLotus gained widespread notoriety for its ability to exploit a previously patched Secure Boot bypass vulnerability tracked under the identifier CVE-2022-21894, which carries a CVSS severity score of 4.4 and is frequently referred to in the security community as Baton Drop.

This specific vulnerability allows attackers to load unsigned, malicious code before the core operating system even begins to boot up. However, successful exploitation of the flaw has historically hinged on a critical prerequisite: the attacker must already possess administrative privileges or physical access to the target host machine. In essence, the bootkit cannot be used as an initial entry vector or a first-stage payload; rather, it serves as a devastatingly effective post-compromise mechanism for maintaining stealth and evasion.

As Microsoft emphasized when the original BlackLotus campaign came to light, the use of such a bootkit by a threat actor functions primarily as a persistence and defense evasion technique. Because it relies on prior access, mitigating the threat completely requires far more than merely installing standard monthly operating system patches. Organizations must also execute manual mitigation steps to apply Microsoft’s Secure Boot revocation measures. These essential measures include adding specific components, such as the "Windows Production PCA 2011" certificate, directly to the Secure Boot UEFI Forbidden List, commonly known as the DBX.

Kaspersky’s recent findings reveal that the threat actors behind the BlackX campaign are heavily capitalizing on the oversight that many targeted organizations have failed to carry out these manual steps. By exploiting this administrative gap, the attackers are able to successfully leverage the Baton Drop vulnerability even on computer systems that are technically running with the standard patches applied. Researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov noted that while a major certificate expired in late 2026, it does not prevent vulnerable binaries from loading unless the certificate is explicitly blocklisted by system administrators.

The researchers added that the threat actors likely recognized that few organizations fully understood the critical importance of manually activating the Baton Drop patch. Consequently, these sophisticated attackers chose to invest significant time and technical resources into reverse-engineering how BlackLotus operates, ultimately developing their own custom copycat bootkit tailored for targeted espionage operations.

In actual deployments observed during the campaign, attackers drop the malware components only after successfully breaching victim networks through alternative, unspecified entry methods and escalating their privileges to obtain administrative control. To install the bootkit successfully, the threat actors execute a specific command-line installer that utilizes an RC4 cryptographic key for decryption purposes. The binary then proceeds to drop additional malicious files onto both the standard system partitions and the hidden UEFI partitions, thereby exploiting CVE-2022-21894 in a manner remarkably similar to the techniques pioneered by BlackLotus.

The ultimate end goal of this exploitation pipeline remains consistent: the installation of Machine Owner Keys to facilitate the loading of arbitrary EFI files on infected hosts and systematically interfere with the integrity of Secure Boot. What makes this development particularly intriguing to security researchers is the fact that the source code of the original BlackLotus bootkit has never leaked into the public domain. This indicates that the creators of BlackX either performed extensive, advanced reverse engineering on the original malware or managed to acquire the source code directly through underground channels.

Security experts point out that it is a relatively rare occurrence for advanced persistent threat actors, who typically develop custom tooling from scratch, to borrow code or tactical concepts from cybercrime syndicates. Following the successful exploitation phase, the delivered UEFI payload is engineered to inject a malicious driver directly into the Windows kernel. This specific driver was found to have been signed using a legitimate certificate belonging to a commercial entity named Wenjiang District Mingyu Network Technology Service Studio, a certificate that has since been revoked by the issuing authority.

Operating similarly to a Bring Your Own Vulnerable Driver attack, the injected driver actively attempts to tamper with the functionality and monitoring capabilities of endpoint security software installed on the machine. In a peculiar behavioral quirk, some of these unauthorized tampering routines are configured to execute only if security programs associated with Kaspersky or Avast are detected on the host. However, subsequent analysis by Kaspersky researchers confirmed that these particular interference routines proved to be largely ineffective in practice.

Beyond attempting to render local security solutions ineffective, the malicious driver also deploys a user-mode payload specifically designed for cyber espionage. The operational connections linking BlackX to the broader APT41 threat ecosystem stem from a comprehensive ESET report published earlier in the year, which documented how a related subgroup known as FishMonger utilized a specialized Windows backdoor called SprySOCKS in targeted attacks against government ministries and entities across Honduras, Taiwan, Thailand, and Pakistan. FishMonger, which is also tracked under alternative aliases such as Aquatic Panda and Earth Lusca, is widely assessed by intelligence analysts to operate under the overarching APT41 umbrella.

Furthermore, Slovakian cybersecurity researchers reported finding limited indications that certain variants of this backdoor may incorporate a UEFI bootkit component likely designed to exploit CVE-2023-24932, another prominent security feature bypass vulnerability historically associated with the BlackLotus lineage. A notable technical overlap strengthening this attribution is the presence of the string "xdd" within both the BlackX binaries and the kernel implants utilized by FishMonger, raising the strong possibility that the UEFI bootkit observed in those regional attacks is indeed BlackX.

An additional fingerprint pointing toward China-aligned threat actors is the heavy reliance on DLL sideloading techniques to deploy subsequent payloads—a behavioral pattern that has historically been extremely common among hacking groups originating from the region. By adapting commercially available crimeware concepts and combining them with state-sponsored espionage frameworks, the group successfully bypassed traditional security procedures intended to protect the fundamental Windows boot process.

Security researchers conclude that this hybrid approach demonstrates how sophisticated adversaries continually evolve, proving that high-level attackers do not always need to reinvent the wheel when they can leverage existing criminal innovations to establish persistent, invisible control over high-value government and diplomatic networks.