Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Original title: Suspected Chinese APT41 Hackers Use BlackX Bootkit to Bypass Windows Secure Boot
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
Kaspersky says a UEFI bootkit it calls BlackX was deployed against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan after network compromise and administrator access. Researchers attribute the operation to APT41 with medium confidence. The installer uses Baton Drop (CVE-2022-21894) to enroll attacker Machine Owner Keys, then a signed driver and user-mode payloads, including a cloud-storage RAT and OxiDLLRunner. Microsoft's Secure Boot revocations are not on by default; applying them without prepared replacements can stop systems from booting.
Unconfirmed: APT41 attribution is medium confidence, and the link to ESET's FishMonger bootkit notes remains inferential.
- BlackX resembles BlackLotus; a development link is not confirmed.
- The kernel driver certificate, issued to a Wenjiang studio, was later revoked.
- One payload uses Google Drive, OneDrive, or Yandex.Disk for command and control.
- OxiDLLRunner sideloads through a renamed googleupdate.exe and contacts archivetj.com.
- Administrators must update DBX and revoke Windows Production PCA 2011 after testing.
Impact: UEFI persistence, kernel driver, and remote access after admin compromise
| Product | Affected |
|---|---|
| Microsoft Windows Secure Boot | Fully patched systems if bootloader revocations are not activated |
- 1.Validate Secure Boot revocation status and follow Microsoft's staged DBX guidance.
- 2.Update recovery media and test boot compatibility before revoking Windows Production PCA 2011.
- 3.Treat inst.exe and the extensionless container PVMDIJGKAX2 as installation artifacts.
- CVEs
- CVE-2022-21894
- ATT&CK
- T1542.003 BootkitT1190 Exploit Public-Facing ApplicationT1574.002 DLL Side-LoadingT1102 Web ServiceT1562.001 Disable or Modify Tools
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41
- Malware
- BlackXBlackLotusOxiDLLRunner
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.archivetj.com | n to expose shellcode and a Rust payload communicating with www[.]archivetj[.]com. Downloaded DLL plugins export create_plugin and execut |
From the original article
2 min read at gbhackers.com
Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Researchers attribute the operation to APT41 with medium confidence. BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.