How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
A sophisticated UEFI bootkit called BlackX has been used in advanced persistent threat attacks against diplomatic agencies in Central Asian countries, exploiting a previously patched vulnerability.
In early 2026, cybersecurity researchers identified a complex advanced persistent threat (APT) attack targeting diplomatic agencies in Central Asian countries, including Tajikistan, Uzbekistan, and Turkmenistan. The attack involved a UEFI bootkit dubbed BlackX, which bears striking similarities to the previously discovered BlackLotus bootkit that emerged in 2022.
BlackX attackers deploy the bootkit after compromising victim networks and obtaining administrator privileges. The installation process involves dropping two files: inst.exe, an installer executable, and PVMDIJGKAX2, an RC4-encrypted file containing necessary components. The installer is launched with a specific command line that includes the decryption key.
The bootkit exploits the Baton Drop vulnerability (CVE-2022-21894) to install custom Machine Owner Keys (MOK), allowing arbitrary EFI files to be loaded on target machines and effectively manipulating Secure Boot. While the implementation is similar to BlackLotus, researchers noted differences in the exploits, suggesting the attackers either reverse-engineered the original bootkit or purchased its source code.
Malicious Payloads
The UEFI payload injects a malicious driver into the Windows kernel, signed by a certificate from 温江区明宇网络技术服务工作室 (Wenjiang District Mingyu Network Technology Service Studio), which has since been revoked. This driver aims to disable security solutions by tampering with process, thread, and registry callbacks, as well as ETW providers.
Curiously, some of the tampering procedures are designed to run only if Kaspersky or Avast solutions are installed on the infected machine. However, during dynamic analysis of this driver, we found that these procedures are useless — they fail to interfere with Kaspersky products in any way.
The driver also protects the bootkit's files by intercepting kernel requests and returning a handle to calc.exe instead of the malicious file. Additionally, it deploys user-mode payloads for cyberespionage, including a remote access trojan (RAT) that uses cloud storage for command-and-control communications and another payload called OxiDLLRunner, which communicates with the www[.]archivetj[.]com C2 server.
Attribution
Researchers have attributed this attack to the APT41 threat actor with medium confidence, based on several factors. The identifier "xdd" appears in BlackX payloads, matching references in a June 2026 ESET blog post about FishMonger (believed to be related to APT41). The payloads' deployment pattern and the use of OLLVM obfuscation, common among Chinese-speaking threat actors, further support this attribution.
Patch Vulnerability
Despite the Baton Drop vulnerability being patched since 2023, the targeted machines were fully patched yet still vulnerable. The issue lies with the patch implementation itself - it requires manual activation to revoke the "Windows Production PCA 2011" certificate used to sign vulnerable UEFI components. This manual process involves setting a registry flag and creating a scheduled task, steps that system administrators typically overlook.
Microsoft had planned an "Enforcement Phase" to automatically revoke the certificate, but this has not yet been implemented. The certificate expired on October 19, 2026, but vulnerable binaries can still load unless the certificate is blocklisted. The attackers likely exploited this gap in patch management, recognizing that few organizations had manually activated the patch.
Related
