Cybersecurity researchers have uncovered an espionage campaign, believed to be conducted by APT41, targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan. This used a malicious UEFI bootkit called BlackX which is similar to previously seen BlackLotus bootkit. The malware exploits a vulnerability within Microsoft’s Secure Boot.
This was discovered during an investigation into attacks targeting diplomatic agencies in early 2026. Researchers believe that APT41 conducted this due to similarities with previous campaigns, and similarities in how the malware was developed.
BlackLotus initially became known in 2022 when it was put up for sale on a hacking forum for $5000. In 2023 ESET confirmed that BlackLotus could bypass Secure Boot by exploiting the Baton Drop vulnerability (CVE-2022-21894).
Although Microsoft have released patches for this, researchers have found that BlackX can still exploit this vulnerability.
Before installing BlackX attackers had gained administrator rights. The instalation tool downloads encrypted elements from another file, making it more difficult to identify the malicious files. BlackX exploits the Baton Drop vulnerability to install custom Machine Owner Keys. This allows the attackers to run unauthorised EFI components.
Once installed BlackX injects a malicious driver into the Windows kernel. The driver will disrupt security tools by disabling callback functions. It will also modify Event Tracing for Windows providers. The driver will attempt to hide the files by intercepting open requests to return a handle which relates to the Windows Calculator application.
Researchers have identified two other pieces of espionage malware.
The first piece is a remote access trojan which uses Google Drive, Microsoft OneDrive or Yandex Disk for C2 communications. This can be used to control the device by sending commands, running .NET code and uploading/downloading files.
The second malware piece is called OxiDLLRunner. This uses obfuscated code to run a Rust component which communicates with the C2 server (www[.]archivetj[.]com). This can be used to send malicious DLL files and run the exported functions.
BlackX has been linked to APT41 as a previous report mentioned a kernel implant and potential UEFI bootkit. The malware also contains the ‘xdd’ marker within the components. The code has also been obfuscated in a way commonly seen with Chinese speaking threat actors. Although these factors have been identified there is uncertainty around this.
Investigation found that it was possible to infect the devices due to the mitigation for Baton Drop in Microsoft requiring manual intervention. This involves setting a registry flag and creating a scheduled task. The automatic mitigation to disable the certificate has not been implemented.
This shows the importance of ensuring that your security mitigations are fully in place. You should check your Secure Boot protections are in place, monitor your security alerts and ensure you have endpoint protection in place which can detect any attempts to exploit.
Read the original article:
APT41 Linked to BlackX Bootkit Attacks on Central Asian Diplomatic Agencies