BlackX bootkit bypasses Secure Boot at Central Asian diplomats

Kaspersky says a BlackLotus-like UEFI bootkit hit diplomatic agencies in three Central Asian countries after attackers already had administrator rights.

Kaspersky says BlackX, a UEFI bootkit, was used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan, and attributes the campaign to China-linked APT41 with medium confidence. After administrator access, it abuses CVE-2022-21894 (Baton Drop) to enroll attacker Machine Owner Keys and load EFI files on patched Windows lacking Secure Boot DBX revocations. A later-revoked kernel driver signed by Wenjiang District Mingyu Network Technology Service Studio disrupts security tools, then a cloud-storage RAT and OxiDLLRunner are deployed. Securelist and The Hacker News say BlackLotus source was never published; BleepingComputer says an incomplete source leaked in July 2023. According to Securelist, the Windows Production PCA 2011 certificate’s October 19, 2026 expiration alone did not stop vulnerable binaries from loading.