BlackX bootkit targets Central Asian diplomacy

A new UEFI bootkit named BlackX has been identified targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. Discovered by Kaspersky researchers in early 2026, the malware is attributed with medium confidence to the Chinese state-sponsored threat actor APT41.

BlackX exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot, allowing it to load malicious drivers before Windows and other security products initialize. This enables the attackers to maintain persistent, hidden access to compromised systems. The malware is noted for its striking similarities to the BlackLotus bootkit, suggesting the developers may have reverse-engineered BlackLotus or acquired its source code.

Technical analysis reveals that BlackX can interfere with security solutions from Kaspersky and Avast. It utilizes a kernel driver signed with a revoked certificate and employs various payloads, including a remote access trojan that communicates via cloud services like Google Drive, OneDrive, and Yandex Disk.

Despite Microsoft releasing patches for the underlying vulnerability in 2022, the threat persists on fully updated systems. Researchers note that the vulnerability remains exploitable unless administrators manually perform specific certificate revocation steps, as the necessary protections are not enabled by default.