Do Son 
Attack path diagram of observed APT41 attack
TL;DR
Security researchers uncovered a new firmware threat called the BlackX UEFI bootkit targeting diplomatic missions across Central Asia in early 2026. Built as a close copy of the infamous BlackLotus malware, the BlackX UEFI bootkit APT41 campaign bypasses Windows Secure Boot on fully updated computers. Because Microsoft’s patch for the underlying Baton Drop flaw requires manual registry activation, even patched networks remain exposed to kernel-level compromise.
What Happened in the Attacks
In early 2026, attackers compromised diplomatic networks in Tajikistan, Uzbekistan, and Turkmenistan and gained administrator privileges. According to a technical report on the BlackX UEFI bootkit by Kaspersky’s Global Research and Analysis Team (GReAT), the intruders deployed a firmware implant modeled after the 2023 BlackLotus bootkit. Specifically, the hackers dropped an executable named inst.exe alongside an RC4-encrypted file named PVMDIJGKAX2. Because the installer keeps all malicious strings hidden inside the encrypted file, incident responders struggle to recover the components without the command-line decryption key.
Once executed, the installer writes files to the system and UEFI partitions to exploit the Baton Drop vulnerability (CVE-2022-21894). Consequently, the exploit installs custom Machine Owner Keys (MOK) to load unauthorized EFI files and bypass Secure Boot. “While the vulnerability exploitation chain was implemented very similarly to BlackLotus, we spotted differences between the exploits in BlackLotus and BlackX,” Kaspersky researchers Georgy Kucherin and Vladimir Nestor wrote. The authors noted that the attackers either reverse-engineered BlackLotus or bought its private source code from cybercriminals.
Kernel Tampering and User-Mode Payloads
During system startup, the BlackX UEFI bootkit injects a malicious driver into the Windows kernel. This driver carries a now-revoked digital signature issued to Wenjiang District Mingyu Network Technology Service Studio. To protect its files on disk, the driver intercepts kernel open requests and returns a harmless handle to calc.exe instead. Furthermore, the driver disables Event Tracing for Windows (ETW) providers and attempts to blind Kaspersky and Avast security tools, though dynamic tests showed its anti-Kaspersky code failed to work.
Next, the kernel driver deploys two distinct user-mode espionage tools. The first payload is a remote access trojan (RAT) that executes secondary .NET modules and communicates via Google Drive, OneDrive, and Yandex.Disk. The second tool, dubbed OxiDLLRunner, uses a legitimate googleupdate.exe binary to side-load an OLLVM-obfuscated DLL. That library decrypts a local binary file and launches a Rust payload that fetches multi-threaded plugins from www.archivetj.com.
Who Is Behind the Activity
Kaspersky attributes this campaign to the Chinese-speaking threat group APT41 with medium confidence. Notably, researchers linked the malware to a June 2026 ESET report detailing attacks by FishMonger, an APT41-affiliated group. In that earlier report, ESET documented a kernel implant containing the debug path C:\Users\xdd\Desktop and suspected the presence of an unknown UEFI bootkit.
“We observed the identifier ‘xdd’ used multiple times in the BlackX bootkit payloads, so we assess that BlackX is the UEFI bootkit referenced in the ESET blog post,” Kaspersky stated. In addition, the reliance on OLLVM obfuscation and DLL side-loading via legitimate binaries closely matches standard APT41 tradecraft.
Impact and the Manual Patch Trap
At first, investigators assumed the diplomatic victims had failed to install Microsoft’s 2023 updates for CVE-2022-21894. However, forensic checks proved that the compromised computers were fully patched. Instead, the breach succeeded because Microsoft’s Baton Drop update does not revoke the vulnerable “Windows Production PCA 2011” certificate automatically, out of fear of breaking dual-boot systems.
“It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch,” the researchers explained. Although the 2011 certificate expired on October 19, 2026, vulnerable bootloaders still run unless administrators manually blocklist the certificate.
How Organizations Can Stay Protected
To defend against the BlackX UEFI bootkit APT41 campaign, IT administrators must do more than just install monthly Windows updates. Specifically, defenders must manually activate the CVE-2022-21894 revocation by setting the required registry flag inside HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot and running the Secure-Boot-Update scheduled task. Additionally, security teams should block connections to www.archivetj.com and monitor endpoints for suspicious executions of inst.exe or unauthorized Google Drive and OneDrive traffic.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
