# BlackX UEFI bootkit targeting diplomatic agencies > Developing situation record from CLSTR: https://clstr.news/situations/blackx-uefi-bootkit-targeting-diplomatic-agencies > Updated: 2026-11-08T03:45:24.000Z. Sources: 2. Developments: 2. Researchers have identified a new UEFI bootkit named BlackX, which targets diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. Attributed with medium confidence to the Chinese state-sponsored actor APT41, the malware exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot. This allows the malware to load malicious drivers before security products initialize, maintaining persistent and hidden access. Technical analysis indicates that BlackX is similar to the BlackLotus bootkit and can interfere with security solutions from Kaspersky and Avast. It utilizes a kernel driver signed with a revoked certificate and employs payloads, such as a remote access trojan, that communicate via cloud services like Google Drive, OneDrive, and Yandex Disk. Despite Microsoft releasing patches for the underlying vulnerability in 2022, the threat persists on fully updated systems. The malware remains effective because it utilizes older components that systems still recognize as trustworthy. Under certain conditions, the vulnerability may also allow attackers to extract BitLocker encryption keys. ## Timeline ### 2026-11-08: BlackX bootkit bypasses Windows Secure Boot The BlackX UEFI bootkit bypasses Windows Secure Boot by exploiting the “Baton Drop” vulnerability, even on updated systems. Researchers also warn of physical dTPM bus-sniffing risks on older hardware. 2 sources. https://clstr.news/cluster/blackx-bootkit-bypasses-windows-secure-boot ### 2026-10-24: BlackX bootkit targets Central Asian diplomacy The BlackX UEFI bootkit, attributed to APT41, has been discovered targeting diplomatic entities in Central Asia by bypassing Secure Boot protections. 4 sources. https://clstr.news/cluster/blackx-uefi-bootkit-bypasses-secure-boot-on-patched-systems --- Cite as: BlackX UEFI bootkit targeting diplomatic agencies. CLSTR, https://clstr.news/situations/blackx-uefi-bootkit-targeting-diplomatic-agencies