BlackX bootkit targets Central Asian diplomatic networks

Cybersecurity researchers have uncovered a campaign targeting diplomatic organisations in three Central Asian countries with BlackX, a bootkit capable of circumventing Windows Secure Boot protections even on updated computers.

Kaspersky disclosed the operation on Thursday, identifying diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan as targets. Its Global Research and Analysis Team linked the activity to APT41, a hacking group associated with China, but assigned only medium confidence to that attribution.

The attacks were detected in early 2026. Kaspersky said its security products prevented an attempted compromise, although investigators subsequently established how the attackers intended to maintain access and deploy espionage tools. The company did not disclose the affected institutions or the number of targeted computers.

BlackX exploits Baton Drop, a Windows Secure Boot bypass vulnerability identified as CVE-2022-21894. The attackers used the weakness after gaining access to internal networks and obtaining administrator privileges, making the bootkit a persistence mechanism rather than the initial means of intrusion.

The discovery highlights a gap between installing security updates and completing the additional measures required to prevent exploitation. Investigators found that targeted computers had received Windows patches, but protections involving revocation of vulnerable boot components had not been fully activated.

Microsoft’s mitigation requires administrators to apply specific Secure Boot changes, including revoking trust in an older Windows signing certificate. Such changes are not necessarily activated simply by installing an update, partly because revocation can interfere with systems dependent on older boot components.

Kaspersky said this distinction allowed attackers to exploit an established vulnerability on machines that appeared fully patched. Its findings underscore the importance of checking whether Secure Boot revocations have actually taken effect, rather than relying solely on ordinary operating system update records.

The researchers identified similarities between BlackX and BlackLotus, an underground bootkit advertised for $5,000 in October 2022. ESET independently established BlackLotus’s capabilities in March 2023, demonstrating its ability to bypass Secure Boot using the same vulnerability.

Kaspersky found that BlackX follows a comparable exploitation sequence, installing attacker-controlled Machine Owner Keys that enable unauthorised EFI components to load during startup. However, the two tools also differ, and researchers could not establish whether BlackX’s developers obtained BlackLotus source code or reconstructed its techniques.

BlackX installs a malicious driver inside the Windows kernel, giving attackers an opportunity to interfere with security software before ordinary protections are fully operational. The driver attempts to disable monitoring callbacks and disrupt Event Tracing for Windows, which security products use to observe system activity.

Some routines specifically targeted Kaspersky and Avast products. Kaspersky said its testing showed that the attempted interference with its own software was ineffective, helping explain why its protection blocked the attack. The findings do not establish that every attempted deployment failed.

The bootkit also supports espionage payloads. One remote access tool communicates through Google Drive, Microsoft OneDrive and Yandex Disk, using legitimate cloud storage services to exchange instructions and transfer information. Such traffic can complicate detection because those services are widely used for authorised business activity.

Another component, named OxiDLLRunner, loads an encrypted payload through a legitimate executable and subsequently runs code written in Rust. Researchers identified a command-and-control domain associated with this component and functionality for retrieving additional malicious modules.

Kaspersky based its tentative APT41 attribution partly on technical overlaps with activity described by ESET, including an identifier appearing in malware development paths. Investigators also identified encrypted payload delivery, DLL sideloading and code obfuscation techniques associated with Chinese-speaking threat actors. None of those indicators alone establishes the operators’ identity.

Researchers presented the investigation at the Security Analyst Summit in Bali, where they detailed how the malware operates below the normal Windows environment. Because the bootkit executes during startup, defenders cannot assume that security tools running later will observe every malicious action. Kaspersky nevertheless stressed that the attackers needed substantial access beforehand, including administrative control of the affected machines, limiting the circumstances in which this particular deployment method could be used.

The installer itself was named inst. exe and worked with a separately encrypted file containing the bootkit components. Keeping those components outside the executable made the malicious material harder for investigators to identify through straightforward file inspection.

The kernel driver carried a digital certificate associated with Wenjiang District Mingyu Network Technology Service Studio. Kaspersky said the certificate had been revoked by its issuer by the time researchers documented the campaign.