BlackX UEFI bootkit targeting diplomatic agencies

Researchers have identified a new UEFI bootkit named BlackX, which targets diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. Attributed with medium confidence to the Chinese state-sponsored actor APT41, the malware exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot. This allows the malware to load malicious drivers before security products initialize, maintaining persistent and hidden access.

Technical analysis indicates that BlackX is similar to the BlackLotus bootkit and can interfere with security solutions from Kaspersky and Avast. It utilizes a kernel driver signed with a revoked certificate and employs payloads, such as a remote access trojan, that communicate via cloud services like Google Drive, OneDrive, and Yandex Disk.

Despite Microsoft releasing patches for the underlying vulnerability in 2022, the threat persists on fully updated systems. The malware remains effective because it utilizes older components that systems still recognize as trustworthy. Under certain conditions, the vulnerability may also allow attackers to extract BitLocker encryption keys.