SECURITY researchers have disclosed a new firmware-based intrusion campaign attributed to APT41, in which a BlackX UEFI bootkit targets diplomatic networks in Central Asia. The operation, observed in early 2026 and detailed by Kaspersky GReAT, deploys a bootkit modelled on the BlackLotus framework. The attackers drop an executable named inst[.]exe and an RC4-encrypted file named PVMDIJGKAX2; responders note that the encrypted payload hides malicious strings, complicating analysis.
The attack chain exploits the Baton Drop vulnerability (CVE-2022-21894) to install custom Machine Owner Keys (MOK) and load unsigned EFI components, bypassing Secure Boot on fully patched machines.
According to the report, the bootkit at system start injects a kernel driver, which signs as a revoked certificate previously issued to Wenjiang District Mingyu Network Technology Service Studio. The driver suppresses kernel openness and disables Event Tracing for Windows, while attempting to blunt security tools such as Kaspersky and Avast (though anti-Kaspersky functionality was not consistently effective in tests).
The drop includes two user-mode payloads: a remote access Trojan that communicates via Google Drive, OneDrive and Yandex[.]Disk, and a second component, OxiDLLRunner, which uses a legitimate googleupdate[.]exe to load an obfuscated DLL that decrypts a local binary and launches a Rust-based module to fetch multi-threaded plugins from archivetj[.]com.
For organisations, mitigation requires manual revocation of CVE-2022-21894 using the registry flag under HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Secureboot and running the Secure-Boot-Update task, plus blocking archivetj[.]com and monitoring for inst[.]exe or unusual cloud traffic.