A new sophisticated UEFI bootkit called BlackX has been identified targeting diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. This malicious activity is believed to be the work of APT41, a hacking group linked to China, as reported by Kaspersky. The primary aim of BlackX is to compromise Microsoft Windows startup defenses and third-party security solutions, ensuring long-term, covert access to the affected systems.

BlackX is an evolution of the BlackLotus bootkit, which first appeared on cybercrime forums in late 2022 and was confirmed in early 2023. BlackLotus exploits a Secure Boot bypass vulnerability known as Baton Drop, tracked as CVE-2022-21894, to load malicious code before the operating system starts. Although this vulnerability has been patched, it requires manual steps to be fully effective, steps which many organizations have overlooked.

Attackers have taken advantage of this oversight by deploying BlackX on systems where patches have been applied but manual revocation steps were not implemented. This includes adding the 'Windows Production PCA 2011' certificate to the Secure Boot UEFI Forbidden List (DBX). The attackers have been able to load vulnerable binaries even after the certificate's expiration on October 19, 2026, due to this lack of action.

After gaining administrator privileges through unspecified means, the attackers install BlackX using a command line execution to drop files that exploit the Baton Drop vulnerability. The bootkit then installs Machine Owner Keys (MOK) to load arbitrary EFI files and interfere with Secure Boot. Notably, the source code for BlackLotus has not been publicly available, suggesting that BlackX was either reverse-engineered or sourced through other means.

BlackX's connection to APT41 is supported by ESET's findings, which link the bootkit to previous campaigns using the SprySOCKS backdoor. This connection is further reinforced by the use of DLL sideloading, a common technique among China-aligned hackers. By leveraging crimeware tools, the group bypasses protections intended to secure Windows boot processes, showcasing their ability to maintain persistent control over high-value networks.