A newly documented UEFI bootkit dubbed BlackX was used in early-2026 espionage attacks against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan, running before Windows loads to maintain persistent access on fully patched machines. Kaspersky’s Global Research and Analysis Team disclosed the toolkit on October 22, 2026, attributing the campaign to the China-linked group APT41 with medium confidence.
BlackX does not rely on a new vulnerability. It exploits the Secure Boot bypass known as Baton Drop, CVE-2022-21894, a flaw with a CVSS score of 4.4 that was published in the National Vulnerability Database on January 11, 2022, as SecNews reported. Exploitation requires attackers to already hold administrator privileges or physical access to the host, a pattern consistent with the earlier BlackLotus bootkit, and the victim machines were running current Windows updates.
How it works
After attackers gain administrative rights inside a victim network, BlackX’s installer writes files to both the system and UEFI partitions and then exploits Baton Drop in a manner researchers describe as very close to BlackLotus. Its central goal is enrolling attacker-controlled Machine Owner Keys (MOKs), which cause the firmware to trust arbitrary EFI binaries supplied by the operator and effectively neutralize Secure Boot, as coverage by Cyberpress explains.
According to BleepingComputer, the UEFI payload also injects a malicious Windows kernel driver signed with a certificate issued to Wenjiang District Mingyu Network Technology Service Studio; the issuing certificate authority has since revoked that certificate. The driver interferes with security-related processes, registry callbacks and Event Tracing for Windows providers, degrading both endpoint protection and forensic visibility.
Two follow-on espionage payloads have been documented. Researchers writing on dev.to describe a .NET remote access trojan that loads additional .NET payloads, collects system information, uploads files of interest and uses Google Drive, OneDrive and Yandex.Disk for command-and-control and exfiltration. A second payload, OxiDLLRunner, uses DLL sideloading via a legitimate googleupdate.exe binary to decrypt a Rust-based implant that contacts the domain archivetj[.]com to download further plugin DLLs.
Who is affected
As of October 25, 2026, the documented victims are Windows systems at diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan. The common factor is that Secure Boot still trusted boot components signed under the Windows Production PCA 2011 certificate, meaning the required Baton Drop revocations had never been completed. There is no evidence in the available reporting of criminal use or targeting outside these high-value victims, but any Windows host that has not enforced the revocation shares the same exposure if an attacker already has admin rights.
What to do
Microsoft’s Baton Drop mitigation works by adding the Windows Production PCA 2011 certificate to the Secure Boot DBX forbidden signature database so vulnerable signed boot components are no longer trusted. Multiple sources stress that installing Windows updates alone does not trigger the revocation. According to Itzine, administrators must:
- Set the registry flag under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot
- Create or allow the Secure-Boot-Update scheduled task to run so the revocation process completes
Kaspersky recommends verifying that these manual revocation steps have been performed, reducing the number of users holding administrator privileges, and deploying tools that monitor firmware integrity and anomalies in the boot chain and kernel drivers. Earlier U.S. Department of Defense BlackLotus mitigation guidance, which already treats CVE-2022-21894 as a key Secure Boot bypass, covers the same DBX and certificate revocation patterns and remains directly applicable to BlackX.
It is not yet known whether Microsoft will issue a new automatic DBX update or a dedicated BlackX advisory, whether organizations beyond the initially affected diplomatic missions have been compromised, or whether indicators such as archivetj[.]com or the revoked Mingyu certificate have been added to major threat-intelligence feeds. No arrests, sanctions or formal government attribution have been announced in connection with the campaign.