BlackX Bootkit Targets Central Asian Diplomatic Entities
A sophisticated UEFI bootkit is exploiting known vulnerabilities to maintain covert access to diplomatic networks.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you feel confident that your computer's security settings are sufficient to block advanced digital threats?
In early 2026, threat actors deployed the BlackX bootkit to compromise diplomatic organizations across Tajikistan, Uzbekistan, and Turkmenistan. The malware serves as a persistence mechanism, allowing attackers to maintain long-term, covert access to sensitive systems.
Why it matters
By hijacking the boot process, BlackX enables threat actors to bypass standard security measures and establish deep-rooted persistence that is difficult to detect or remove. This capability allows attackers to evade traditional defense systems while maintaining control over high-value targets.
The BlackX bootkit utilizes the Baton Drop vulnerability, designated as CVE-2022-21894 with a 4.4 CVSS score, to exploit systems lacking manual Secure Boot revocation. It relies on the installation of Machine Owner Keys to load arbitrary EFI files.
The players
ESET
This global cybersecurity company specializes in malware research and provides threat intelligence reports on advanced persistent threats.
APT41
This Chinese state-sponsored threat group is known for conducting both espionage and financially motivated cyberattacks globally.
The details
The bootkit functions as an updated iteration of the BlackLotus malware and requires administrator privileges or physical access to infect the target host. It uses legitimate services including Google Drive, OneDrive, and Yandex.Disk for command-and-control communications.
Timeline
Late 2022: BlackLotus bootkit is first advertised on cybercrime forums.
March 2023: ESET confirms the existence of the BlackLotus bootkit.
Early 2026: BlackX targets diplomatic entities in Central Asia.
June 2026: An ESET report links FishMonger activity to APT41.
October 19, 2026: The Windows Production PCA 2011 certificate expires.
The Tech Race
The emergence of BlackX highlights the ongoing struggle to secure the UEFI boot process against sophisticated persistent threats. This development reflects a wider shift as state-aligned actors pivot away from legacy bootkits to exploit specific gaps in secure boot revocation protocols.
Security administrators must manually add the Windows Production PCA 2011 certificate to the UEFI Forbidden List to properly mitigate the Baton Drop vulnerability. Failure to implement this specific revocation leaves systems susceptible to malicious driver loading and persistent boot-level compromise.
The takeaway
Organizations should prioritize strict physical access controls and ensure that secure boot policies are kept up to date to prevent bootkit installation. Regularly auditing UEFI configurations against known vulnerabilities is essential for defending against deep-level persistence threats.
Further reading
For more information on emerging threats, visit the Cybersecurity section.
Source note: This article includes information reported by The Hacker News.
Live Poll
Do you feel confident that your computer's security settings are sufficient to block advanced digital threats?
