APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
Original title: How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
Kaspersky says a campaign it possibly attributes to APT41 used a UEFI bootkit called BlackX against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. After administrator access, an installer decrypts an RC4 package and abuses Baton Drop (CVE-2022-21894) much like BlackLotus, whose source was never published. The bootkit injects a driver, signed by Wenjiang District Mingyu Network Technology Service Studio, that tries to blind security tools, then deploys a cloud-storage RAT and OxiDLLRunner. The certificate has been revoked.
Unconfirmed: Kaspersky calls the APT41 link a possible attribution and does not publish BlackLotus source proof.
- Installer command uses inst.exe, file PVMDIJGKAX2, and an RC4 key.
- The RAT talks to Google Drive, OneDrive, and Yandex.Disk via numbered file suffixes.
- OxiDLLRunner is an OLLVM-obfuscated DLL loaded by a delivered googleupdate.exe.
- Driver tampering aimed at Kaspersky failed in dynamic analysis; the Avast path is also described.
- BlackLotus had been quiet publicly after Microsoft’s 2023 Secure Boot updates.
Impact: Secure Boot bypass, kernel driver injection, and espionage access
| Product | Affected |
|---|---|
| Microsoft Windows Secure Boot | — |
- CVEs
- CVE-2022-21894
- ATT&CK
- T1542.003 BootkitT1562.001 Disable or Modify ToolsT1102.002 Bidirectional CommunicationT1574.002 DLL Side-Loading
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41
- Malware
- BlackXBlackLotusOxiDLLRunner
- Countries
- TajikistanUzbekistanTurkmenistan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.archivetj.com | e, which is a Rust payload designed to communicate with the www[.]archivetj[.]com C2 server. During communication, this payload is suppos |
| md5 | 0bcdf5e0da32d68900b8b7638459d072 | ). At the time of writing, this certificate (serial number: 0bcdf5e0da32d68900b8b7638459d072) has been revoked by its issuer. The driver aims to tamper |
| md5 | af8a983b9ada07eae1259bf2953abd40 | googleupdate.exe (original filename: jcef_helper.exe , MD5: AF8A983B9ADA07EAE1259BF2953ABD40), which is also delivered by the bootkit. The DLL decrypts |
From the original article
7 min read at securelist.com
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
By Georgy Kucherin, Vladimir Nestor, Vasily Berdnikov · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.