Kaspersky Ties BlackX Bootkit to APT41 Campaign in Central Asia

Kaspersky has published an analysis of a UEFI bootkit called BlackX that was used in an espionage campaign in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, according to BleepingComputer. The bootkit bypassed Secure Boot by exploiting the Baton Drop vulnerability, tracked as CVE-2022-21894.

Kaspersky found that BlackX's exploit implementation closely resembles that of BlackLotus, an earlier bootkit. BlackX loads a malicious Windows kernel driver signed with a revoked certificate issued to Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and tampers with ETW providers, with some of that tampering triggered only when Kaspersky or Avast products are detected. It also protects the bootkit's files by launching the Windows Calculator when users try to open them.

The bootkit deploys a remote access trojan that uses Google Drive, OneDrive or Yandex.Disk for command-and-control, along with a DLL sideloader called OxiDLLRunner. All observed victims ran fully patched Windows, but administrators had not manually activated the additional Secure Boot revocations.

Attribution and certificate deadline

The campaign is attributed with medium confidence to APT41, the Chinese state-sponsored group also known as Brass Typhoon, Wicked Panda and Barium. Kaspersky's findings underline a timing issue for defenders: the Windows Production PCA 2011 certificate expires on October 19, 2026, but vulnerable binaries will still load unless the certificate is blocklisted.

BlackLotus has circulated on hacker forums since October 2022, and its source code leaked in July 2023. ESET confirmed in March 2023 that BlackLotus exploited Baton Drop to compromise fully patched Windows 11 systems.