Threat actors have revived tactics reminiscent of the notorious BlackLotus bootkit to circumvent Windows Secure Boot protections and deploy sophisticated espionage malware against diplomatic and government organizations across Central Asia. The newly identified bootkit, dubbed BlackX, was observed in targeted attacks against institutions in Tajikistan, Uzbekistan, and Turkmenistan during the first half of 2026.
While researchers found several indicators pointing toward the Chinese-linked threat group APT41, the evidence was deemed only strong enough for a medium-confidence assessment, stopping short of definitive attribution.
What makes the campaign particularly concerning is that the compromised systems were not running outdated software. Investigators determined that the affected machines had received the latest security updates, yet remained vulnerable because critical Secure Boot certificate revocations had not been fully enforced. As a result, legacy boot components containing known vulnerabilities continued to be trusted during startup, creating an opening for attackers despite otherwise up-to-date systems.
Security researchers at Securelist uncovered the operation and detailed their findings in a technical analysis published on October 22. According to their report, BlackX closely mirrors the attack methodology employed by BlackLotus, although its internal architecture, deployment mechanisms, and espionage payloads differ significantly from the original malware.
BlackX Exploits Baton Drop Vulnerability
At the heart of the attack is the exploitation of Baton Drop (CVE-2022-21894), a vulnerability that allows attackers to compromise the integrity of the Windows boot process. Unlike an initial access tool, BlackX is deployed only after threat actors have already breached a target environment and obtained administrator-level privileges.
The researchers noted that BlackX serves primarily as a persistence and post-exploitation framework, enabling attackers to deepen and maintain access to already-compromised systems. The report does not reveal how the targeted organizations were initially infiltrated.
To evade detection and hinder forensic investigations, the malware's installation process separates the primary executable from an encrypted companion package containing essential components, configuration data, and strings. This modular approach leaves the installer itself largely devoid of obvious malicious content, making analysis considerably more difficult if investigators fail to recover the associated encrypted package.
Once executed, the malware writes files to both Windows system partitions and UEFI storage areas before exploiting the Baton Drop flaw to install attacker-controlled Machine Owner Keys (MOKs). These rogue keys enable malicious EFI components to load during startup while appearing legitimate to the Secure Boot process.
The bootkit then injects a digitally signed malicious driver into the Windows kernel. Although the certificate used to sign the driver has since been revoked, the driver is capable of attempting to disable security monitoring callbacks and tamper with Event Tracing for Windows (ETW), reducing visibility into malicious activity and hindering threat detection.
Researchers also discovered efforts to interfere specifically with Kaspersky security products, although those mechanisms failed during testing. Additionally, BlackX conceals critical bootkit files by redirecting access requests to a legitimate Windows executable, helping it remain hidden from administrators and security tools.
Advanced Espionage Capabilities
Following successful installation, BlackX deploys two distinct user-mode malware components designed for long-term intelligence gathering and remote control.
The first payload functions as a Remote Access Trojan (RAT) capable of executing additional .NET-based modules on infected devices. To blend malicious communications with legitimate traffic, the malware uses popular cloud storage platforms such as Google Drive, Microsoft OneDrive, and Yandex Disk as command-and-control channels.
Researchers noted similarities between these communication methods and techniques previously associated with APT41 operations. However, they cautioned that the use of similar infrastructure alone is not sufficient to conclusively attribute the campaign to the group.
The second payload, known as OxiDLLRunner, utilizes DLL sideloading techniques by leveraging a legitimate application to load an obfuscated malicious DLL. The malware decrypts a nearby data file containing shellcode and a Rust-based executable, which subsequently connects to attacker-controlled infrastructure.
Once communication is established, operators can deliver additional DLL-based plugins that execute in separate threads, allowing the malware's functionality to be expanded on demand. This modular architecture provides attackers with significant flexibility for surveillance, lateral movement, credential theft, or other post-compromise operations.
Attribution Remains Uncertain
Researchers based their assessment linking the campaign to APT41 on several factors, including shared development artifacts, similarities with previously documented FishMonger activity, recurring DLL sideloading techniques, and the use of OLLVM obfuscation.
Despite these overlaps, investigators emphasized that the available evidence does not definitively identify the developers or operators behind BlackX. They suggested two possible scenarios: the creators may have independently reverse-engineered BlackLotus techniques or obtained portions of the original source code. Neither theory has been verified.
Secure Boot Revocation Gap Leaves Systems Exposed
A key finding from the investigation is that patching Windows alone may not be sufficient to protect systems from certain Secure Boot attacks.
Researchers found that vulnerable boot components signed under the Windows Production PCA 2011 certificate continued to be trusted even after security updates were installed. In many cases, organizations had not enabled the additional certificate revocation measures necessary to block those components from loading.
Furthermore, the expiration of the certificate on October 19 did not automatically invalidate previously trusted binaries. Existing systems continued to boot normally, meaning vulnerable components could remain usable unless administrators explicitly applied the appropriate revocation policies.
The incident highlights a broader challenge with Secure Boot protections: organizations must verify that revocation databases and forbidden-signature lists are properly updated, rather than relying solely on operating system patch status.
Security experts recommend carefully planning and testing Secure Boot revocations before deployment, as older recovery images, legacy boot configurations, and outdated system media may depend on certificates that are scheduled for removal. Failure to account for compatibility issues could disrupt recovery processes while attempting to strengthen security defenses.
The BlackX campaign serves as a reminder that even fully patched systems can remain vulnerable when trust relationships within the boot process are not completely updated, giving determined attackers an opportunity to establish stealthy, highly persistent footholds deep within the operating system.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
