APT41 Revives BlackLotus UEFI Bootkit as BlackX, Targets Central Asian Diplomacy
The notorious BlackLotus UEFI bootkit has resurfaced under the name BlackX, wielded by the APT41 threat group in sophisticated attacks against diplomatic organizations in Central Asia.
Cybersecurity researchers have uncovered a significant resurgence of advanced persistent threat (APT) activity, with the APT41 group reviving the potent BlackLotus UEFI bootkit, now identified as BlackX. This sophisticated malware was observed in targeted attacks against diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan during early 2026. The campaign highlights the enduring threat of bootkits and the evolving tactics of nation-state actors.
The BlackX bootkit leverages the Baton Drop vulnerability (CVE-2022-21894), a flaw that allows it to bypass Secure Boot, a critical security feature designed to prevent unauthorized operating system loaders. By exploiting this vulnerability, attackers can install custom Machine Owner Keys (MOKs), enabling them to load arbitrary EFI files and effectively subvert the system's boot process. This allows for deep-level compromise before the operating system even fully loads, providing a stealthy and persistent foothold.
The initial discovery of BlackLotus dates back to late 2022 when it was advertised on hacking forums for a surprisingly low price, initially met with skepticism. However, by March 2023, researchers confirmed its capabilities, noting that Microsoft had to issue multiple patches to address the underlying Baton Drop vulnerability. Following these updates, the bootkit appeared to go dormant until its reappearance in the APT41 campaign.
The infection chain begins with attackers gaining administrative privileges within the victim's network. They then deploy an installer executable, inst.exe, which is designed to be difficult for incident responders to analyze as it unpacks necessary components from an RC4-encrypted file. This installer then drops malicious files onto both system and UEFI partitions to execute the Baton Drop exploit, mirroring the implementation seen in the original BlackLotus.
Once the Baton Drop vulnerability is exploited, the bootkit installs a malicious UEFI payload. This payload's primary function is to inject a custom driver into the Windows kernel. This driver is digitally signed with a certificate from a Chinese entity, "Wenjiang District Mingyu Network Technology Service Studio," though this certificate has since been revoked. The driver is engineered to disable security solutions by tampering with kernel callbacks and Event Tracing for Windows (ETW) providers, specifically targeting Kaspersky and Avast, though its effectiveness against Kaspersky was limited during testing.
Beyond disabling security software, the kernel driver also protects the bootkit's own files from detection and tampering by intercepting file access requests and redirecting them to a benign executable like calc.exe. This self-preservation mechanism further enhances the bootkit's stealth and persistence.
The BlackX bootkit doesn't stop at the kernel level; it also deploys user-mode payloads for espionage. Researchers observed two such payloads: a Remote Access Trojan (RAT) capable of loading further .NET-based malware, and a second DLL-based payload named OxiDLLRunner. The RAT utilizes cloud storage services like Google Drive, OneDrive, and Yandex.Disk for command and control (C2) communications, receiving instructions and exfiltrating data through specially formatted files. OxiDLLRunner, obfuscated with OLLVM, is loaded by a legitimate Google update executable, googleupdate.exe, to execute further malicious actions.
The involvement of APT41, a group known for its diverse targeting and state-sponsorship, in reviving and adapting the BlackLotus bootkit signifies a concerning trend. The reuse of sophisticated cybercrime tools by APT actors, coupled with the targeting of sensitive diplomatic organizations, underscores the persistent and evolving nature of advanced cyber threats.