Executive Summary
In early 2026, diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan were targeted by a sophisticated UEFI bootkit dubbed BlackX. Attributed to the China-linked threat actor APT41 (specifically the FishMonger subgroup), BlackX represents a refined evolution of the BlackLotus crimeware. The bootkit exploits the 'Baton Drop' vulnerability (CVE-2022-21894) to bypass Windows Secure Boot defenses, even on patched systems where manual revocation steps for vulnerable boot managers have not been applied.
The attack chain involves gaining administrative access to deploy an installer that drops malicious drivers and user-mode payloads. These components are designed to disable security software, particularly targeting Kaspersky and Avast, and establish long-term persistence. The transition of code once exclusive to cybercrime forums into the hands of state-sponsored actors underscores a shifting landscape where APTs adopt and weaponize high-end commercial malware to bypass boot-level protections.
The impact is significant for organizations relying solely on standard Windows updates without implementing Microsoft's manual Secure Boot revocation mitigations. Successful deployment allows the adversary to maintain invisible control over high-value networks, execute remote access trojans, and exfiltrate data via cloud services like Google Drive and OneDrive.