Diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan have been hit by a sophisticated malware called BlackX that attacks computer firmware before the operating system loads, according to a technical report published this week by Kaspersky. The campaign, which targeted diplomatic entities in early 2026, is believed to be the work of APT41, a state-sponsored hacking group linked to China. The bootkit's main purpose is to disable Windows startup protections and third-party security tools while keeping long-term, hidden access to infected machines.

BlackX represents an updated version of BlackLotus, a notorious bootkit first advertised on cybercrime forums in late 2022 and officially confirmed by ESET in March 2023, the report states. The malware exploits a patched Secure Boot bypass flaw tracked as CVE-2022-21894, also called Baton Drop, to run malicious code before the operating system starts—but only if attackers already have administrator rights or physical access to the target machine. Hackers are taking advantage of the fact that many organizations haven't completed the manual steps required to fully block the vulnerability, even on systems where the patch has been installed. One critical step involves adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List, which expired on October 19, 2026, but still allows vulnerable files to load unless specifically blocklisted. Attackers install BlackX by dropping two files—inst.exe and an encrypted file called PVMDIJGKAX2—then running the installer with an RC4 decryption key via command line. The bootkit then injects a malicious driver into the Windows kernel, signed with a certificate from Wenjiang District Mingyu Network Technology Service Studio that has since been revoked. The driver targets security software from Kaspersky and Avast, though those routines have been found ineffective. It also delivers two espionage payloads: a remote access trojan using Google Drive, OneDrive, and Yandex.Disk for command-and-control operations, and a DLL called OxiDLLRunner that launches a Rust payload communicating with "archivetj[.]com."

"It is critical to note that a threat actor's use of this bootkit is primarily a persistence and defense evasion mechanism," Microsoft noted at the time of the original BlackLotus discovery. "It is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access." Kaspersky researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov wrote that "it is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch." What makes this case particularly unusual is that BlackLotus source code has never been publicly released, according to the report, meaning the hackers behind BlackX either reverse-engineered the original bootkit or bought its source code from another party. "Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors," Kaspersky stated.

The attribution to APT41 comes from several pieces of evidence, including connections to an ESET report from June 2026 that documented a subgroup called FishMonger using similar techniques in attacks on government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024, the analysis explains. FishMonger, also tracked as Aquatic Panda and Earth Lusca, is considered part of the APT41 umbrella. ESET found limited signs that some versions of FishMonger's backdoor may include a UEFI bootkit component exploiting CVE-2023-24932, another security feature bypass tied to BlackLotus. Both BlackX and FishMonger's kernel implant contain the string "xdd," suggesting the UEFI bootkit used in those earlier attacks might actually be BlackX. The second clue pointing to Chinese hackers is the use of DLL sideloading to deploy payloads—a technique extremely common among threat actors of Chinese origin. "By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes," Kucherin said. Organizations that haven't manually activated the full mitigation steps for CVE-2022-21894 remain vulnerable even if they've installed the official patch, leaving a window for sophisticated adversaries to maintain invisible control over high-value networks. The unusual crossover between cybercrime tools and state-sponsored operations may signal a shift in how advanced persistent threat groups acquire capabilities without building everything from scratch. Firmware-level compromises will likely demand renewed attention from security teams who've traditionally focused defense resources on operating system and application layers.