A new UEFI bootkit called BlackX has been observed targeting diplomatic organisations in Central Asia, specifically Tajikistan, Uzbekistan and Turkmenistan, in early 2026. The operation appears to be a more capable evolution of the BlackLotus bootkit and is linked to the China‑aligned APT41 cluster. The aim of BlackX is to defeat Microsoft Windows startup protections and third‑party security tools to maintain long‑term persistence on compromised devices.
Researchers from Kaspersky describe BlackX as loading prior to the operating system, enabling the attacker to load and execute malicious code while Secure Boot is still in effect, effectively bypassing safeguards designed to stop such tampering.
Technical details indicate that BlackX exploits CVE‑2022‑21894 (Baton Drop), a now‑patched Secure Boot bypass, to install its UEFI payload. The malware copies itself to system and UEFI partitions, installs a bootkit that can load arbitrary EFI files via Machine Owner Keys (MOK), and tampers with security software. A signed kernel driver, allegedly signed with a certificate later revoked, is used to inject a payload and sideload a user‑mode component.
Several capabilities are observed, including a remote access trojan and a DLL payload (OxiDLLRunner) that leverages additional DLL plugins. The threat actors reportedly deploy BlackX after gaining administrator privileges or physical access, abusing a patch‑despite‑revocation gap to continue using Baton Drop.
Practical responses include applying Microsoft’s Secure Boot revocation mitigations manually—adding the Windows Production PCA 2011 certificate to the Secure Boot DBX—and revoking vulnerable boot managers to close the loophole.