KASPERSKY Securelist reveals that in early 2026 an APT campaign targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan employed a UEFI bootkit named BlackX, closely resembling the BlackLotus malware. The attackers gained initial access and elevated privileges before dropping an installer (inst[.]exe) and an encrypted payload bundle (PVMDIJGKAX2).
The exploit chain leverages Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys, enabling the loading of EFI files even with Secure Boot enabled. The drop includes files on both system and UEFI partitions, crafted to mirror BlackLotus’ approach, although the bootkit components’ source code remains undisclosed.
The Windows kernel is targeted through a signed driver intended to disable security software callbacks and tamper with ETW, with some anti‑analysis logic appearing to respond only when certain vendors (e.g., Kaspersky or Avast) are detected, though these checks ultimately prove ineffective against Kaspersky products.
Two user‑mode payloads accompany the bootkit. One is a cyber‑espionage RAT that uses cloud storage services (Google Drive, OneDrive, Yandex[.]Disk) as a C2 channel, iterating through stored files and executing commands based on file suffixes. The other component, OxiDLLRunner, uses obfuscated code to load a Rust payload that communicates with a C2 at www.archivetj[.]com and loads DLLs exporting create_plugin.
The latter is delivered via a compromised instance of googleupdate[.]exe, and a decrypted v8_context_snapshot.bin is executed to run shellcode and a PE payload. Attribution is stated with medium confidence to APT41, based on patterns such as DLL sideloading, encrypted archives, and the use of OLLVM obfuscation. The researchers note that patches intended to revoke the Windows Production PCA 2011 certificate must be actively triggered by users, a reliance that contributed to the campaign’s success.