Science & Tech · Cybersecurity · 5 hrs ago
BlackX bootkit targets diplomatic groups in three Central Asian countries
Diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan were targeted by a new malware campaign in early 2026.
The malware, called BlackX, is a bootkit designed to undermine Windows startup protections and stay hidden on infected computers.
Researchers suspect the China-linked hacking group APT41 is behind the campaign.
BlackX appears to be an updated version of BlackLotus, which exploits a Secure Boot flaw known as Baton Drop.
Attackers need administrator access or physical access first, so the bootkit is used to maintain access rather than break into a device initially.
Systems can remain vulnerable even after a standard update if organizations have not manually applied the required Secure Boot revocations.
The malware can disable security software and install espionage tools, making the campaign a risk to affected organizations.
Organizations need to complete those manual security steps; the sources do not describe any further response.
Diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan were targeted by the BlackX UEFI bootkit in early 2026.
Kaspersky researchers suspect the campaign was conducted by the China-linked APT41 group.
BlackX is assessed to be an updated version of BlackLotus and is designed to bypass Windows startup defenses and Secure Boot.
The attackers exploited CVE-2022-21894 on systems where organizations had not manually applied Secure Boot revocation mitigations.
The bootkit can help attackers maintain covert access and disable security software after they have gained administrator privileges or physical access.
- Who
- Diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan were targeted. Kaspersky suspects China-linked APT41 was behind the campaign.
- What
- A UEFI bootkit called BlackX was deployed to undermine Windows startup defenses and maintain covert access.
- When
- Early 2026.
- Where
- Tajikistan, Uzbekistan and Turkmenistan.
- Why
- The malware is intended to maintain long-term access, evade defenses and support espionage.
This story does not have two clearly opposing sides.
BlackLotus was first observed being advertised on cybercrime forums.
ESET officially confirmed the existence of BlackLotus.
Diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan were targeted by the BlackX campaign.
The Windows Production PCA 2011 certificate expired, but vulnerable binaries could still load unless the certificate was blocklisted.
- Bootkit
- BlackX
- Target countries
- Tajikistan, Uzbekistan and Turkmenistan
- Suspected group
- APT41
- Vulnerability
- CVE-2022-21894, also known as Baton Drop
- BlackX predecessor
- BlackLotus
- Campaign period
- Early 2026
2 sources
What people are saying
It is critical to note that a threat actor's use of this bootkit is primarily a persistence and defense evasion mechanism
It is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access.
It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch.
Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors