Diplomatic organizations in Central Asia have been targeted by a sophisticated Unified Extensible Firmware Interface (UEFI) bootkit known as BlackX, which is designed to bypass Windows startup protections, weaken security defenses, and establish persistent access to compromised systems.
The campaign, observed in early 2026, targeted diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan. Researchers suspect that the activity is linked to APT41, a China-aligned state-sponsored threat group known for conducting cyber espionage and deploying advanced malware.
BlackX appears to be an updated version of BlackLotus, a notorious UEFI bootkit first advertised on cybercrime forums in late 2022 and publicly confirmed in March 2023.
The malware’s primary purpose is to compromise the Windows boot process before the operating system starts, making detection and removal more difficult while enabling attackers to maintain long-term access to high-value targets.
BlackX Builds on BlackLotus Bootkit Capabilities
BlackLotus is known for exploiting CVE-2022-21894, a Secure Boot bypass vulnerability commonly referred to as Baton Drop. The vulnerability has a CVSS score of 4.4 and can allow malicious code to load before the operating system starts.
However, exploiting the vulnerability requires an attacker to have already obtained administrator privileges or physical access to the targeted device.
Microsoft previously emphasized that BlackLotus is primarily a persistence and defense-evasion mechanism rather than an initial access tool. An attacker must first compromise a system before deploying the bootkit.
Although security updates address the underlying vulnerability, additional mitigation steps are necessary to fully protect affected systems. These include applying Microsoft’s Secure Boot revocation measures and updating the UEFI Forbidden Signature Database (DBX) to block vulnerable boot components.
Researchers found that attackers are taking advantage of organizations that have installed updates but have not completed the required manual mitigation steps.
On October 19, 2026, the relevant certificate expired. However, certificate expiration alone does not prevent vulnerable binaries from loading if they have not been explicitly blocked through the appropriate Secure Boot revocation mechanisms.
Researchers believe the attackers studied BlackLotus and developed a similar bootkit to exploit this gap in protection.
How Attackers Deploy the BlackX Bootkit
The observed attacks involved threat actors breaching victim networks through an unknown initial access method and obtaining administrator privileges before attempting to install BlackX.
The installation process uses two primary files:
inst.exe— The installer executable responsible for deploying the bootkit.PVMDIJGKAX2— An encrypted file without a conventional file extension that contains installation components and required strings.
The installer is executed through the Windows command line using the following format:
C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1
In this command, Q46F6MDLI3RX2KV1 serves as the RC4 decryption key.
After execution, the installer places additional files on both the Windows system partition and the UEFI system partition. The installation process exploits CVE-2022-21894 in a manner closely resembling the techniques used by BlackLotus.
The ultimate objective is to install Machine Owner Keys (MOK), enabling unauthorized EFI files to be loaded on compromised systems and undermining Secure Boot protections.
One notable aspect of BlackX is that the original BlackLotus source code has never been publicly released. This suggests that its developers either reverse-engineered BlackLotus or obtained its source code from another party.
The reuse of techniques associated with commercial cybercrime tools by a suspected state-sponsored group highlights how sophisticated attackers can adapt existing malware rather than develop every component from scratch.
Malicious Driver Attempts to Disable Security Protections
Following exploitation, BlackX deploys a UEFI payload designed to inject a malicious driver into the Windows kernel.
The driver was signed using a certificate associated with Wenjiang District Mingyu Network Technology Service Studio. The certificate has since been revoked by its issuer.
The driver employs techniques resembling a bring-your-own-vulnerable-driver (BYOVD) attack, attempting to interfere with endpoint security software running on infected systems.
Interestingly, some of its routines were designed to perform unauthorized modifications only when security products associated with specific vendors were present. However, analysis indicated that these routines were ineffective.
Beyond attempting to interfere with security tools, the driver also facilitates the deployment of additional malware for cyber espionage.
Researchers identified two principal payloads associated with the campaign.
1. Remote Access Trojan
The first payload is a remote access trojan (RAT) capable of delivering additional .NET components.
It uses Google Drive, Microsoft OneDrive, and Yandex.Disk for command-and-control (C2) communications, allowing malicious traffic to blend in with legitimate enterprise activity.
The RAT can collect system information, transfer files of interest, and provide attackers with a means of maintaining access to compromised devices.
2. OxiDLLRunner Malware Loader
The second payload is a malicious DLL known as OxiDLLRunner.
The DLL is sideloaded through the legitimate googleupdate.exe executable, which is also delivered as part of the bootkit infection chain.
It decrypts and executes a Rust-based payload that communicates with archivetj[.]com to receive and run additional DLL plugins.
DLL sideloading allows attackers to exploit the execution behavior of legitimate applications to load malicious code, potentially making their activity harder to distinguish from normal software operations.
BlackX Shows Possible Connections to APT41
The suspected connection between BlackX and APT41 is based partly on previously documented activity involving a threat cluster known as FishMonger.
A June 2026 report linked FishMonger to attacks conducted between 2023 and 2024 against government organizations in Honduras, Taiwan, Thailand, and Pakistan. The group used a Windows backdoor called SprySOCKS in these operations.
FishMonger is also tracked under the names Aquatic Panda and Earth Lusca and has been assessed as operating within the broader APT41 ecosystem.
Researchers identified limited evidence that certain versions of SprySOCKS may include a UEFI bootkit component, potentially exploiting CVE-2023-24932, another Secure Boot bypass vulnerability associated with BlackLotus.
An additional technical overlap is the presence of the string xdd in both BlackX and a kernel implant associated with FishMonger. This raises the possibility that the UEFI bootkit used in earlier operations may be BlackX or a closely related variant.
The use of DLL sideloading to deliver malicious payloads provides another potential link, as the technique has been observed frequently in operations attributed to Chinese-aligned threat actors.
However, these similarities do not independently establish attribution, and the connection to APT41 remains an assessment based on the available technical evidence.
BlackX Highlights the Risks of Firmware-Level Malware
BlackX demonstrates how attackers can combine firmware-level persistence with conventional malware delivery techniques to compromise high-value networks.
By targeting the boot process, the malware seeks to operate beneath the Windows security environment and establish persistence that may survive routine operating system remediation.
Its ability to deploy kernel-level components, interfere with endpoint security software, and deliver espionage-focused payloads makes it particularly concerning for diplomatic organizations and other sensitive targets.
Organizations should ensure that Secure Boot protections are correctly configured, apply all relevant firmware and operating system security updates, and complete the necessary revocation steps rather than relying on patch installation alone.
Security teams should also investigate suspicious administrative activity, unexpected EFI files, unauthorized changes to Secure Boot configuration, unusual driver installations, and outbound connections associated with unfamiliar cloud storage or command-and-control infrastructure.
The BlackX campaign illustrates a broader trend in advanced cyber operations: threat actors can repurpose existing bootkit technology and combine it with modern malware loaders to achieve stealthy, long-term access to sensitive systems.
