Threat reportMalwareTL-2026-4118
APT41 BlackX UEFI bootkit (BlackLotus-derived) targets Central Asian diplomatic organizations via CVE-2022-21894 (Baton Drop)
APT41 BlackX UEFI bootkit (BlackLotus-derived) targets (TL-2026-4118), also tracked as BlackX, is a critical-severity malware campaign scored CVSS 4.4, first published 2026-10-22. It is attributed to APT41 (China) with medium confidence, affects Microsoft Windows (10, 11, 8.1) and Windows Server 2012-2022, references 2 CVEs (CVE-2022-21894, CVE-2023-24932), maps to 11 MITRE ATT&CK techniques (T1014, T1027, T1036.005), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 4.4/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 1APT41
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4118
- Threat ID
- TL-2026-4118
- Also known as
- BlackX, BlackLotus-derived bootkit
- Severity
- CRITICAL
- CVSS
- 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT41
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, diplomatic
- Target regions
- 143 - Central Asia, tajikistan, uzbekistan, turkmenistan
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
Malware and tooling: BlackLotus, BlackX, OxiDLLRunner
How APT41 BlackX UEFI bootkit (BlackLotus-derived) targets works
Securelist (Kaspersky) reports BlackX, a UEFI bootkit closely resembling BlackLotus, used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on fully patched systems where Microsoft's manually-activated mitigation was not enabled. Attribution to APT41 is assessed at medium confidence.
BlackX is a UEFI bootkit whose implementation Kaspersky describes as remarkably similar to BlackLotus, the bootkit first advertised on a hacking forum in October 2022 for about USD 5,000 and analyzed by ESET in March 2023. BlackX abuses Baton Drop (CVE-2022-21894), a Secure Boot security feature bypass in Windows boot components signed by the 'Windows Production PCA 2011' certificate. The Microsoft fix for this class of bug requires manual activation (a Secure Boot registry flag and the Secure-Boot-Update scheduled task) and the automatic revocation 'Enforcement Phase' had not been implemented as of the report, so fully patched systems remain exploitable. The bootkit installs custom Machine Owner Keys (MOK) so that arbitrary EFI binaries load under Secure Boot.
Deployment starts with a benign-looking installer, inst.exe, launched as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. PVMDIJGKAX2 is an extensionless RC4-encrypted container holding every bootkit component and the final argument is the RC4 key, so the installer carries no malicious strings. Components are written to the system and UEFI partitions. A kernel driver signed with a certificate issued to the Chinese entity 'Wenjiang District Mingyu Network Technology Service Studio' (serial 0bcdf5e0da32d68900b8b7638459d072, since revoked) tampers with process, thread and registry callbacks and with ETW providers to blind security products. It has routines aimed at Kaspersky and Avast that run only when those products are present (reported as ineffective), and it intercepts kernel file-open requests for the bootkit's files, returning a handle to calc.exe instead.
User-mode payloads include a RAT that loads .NET second-stage payloads and uses Google Drive, OneDrive and Yandex.Disk as C2, exchanging files distinguished by suffixes 0x01-0x06 and SSSR (initial system information); remote commands run through TEST.Class1.RunCMD. A second payload, OxiDLLRunner (OLLVM-obfuscated), is sideloaded by a legitimate jcef_helper.exe binary renamed googleupdate.exe, which decrypts the RC4-encrypted v8_context_snapshot.bin into shellcode followed by a Rust PE. It beacons to www.archivetj.com and executes plugin DLLs exporting create_plugin in separate threads.
Kaspersky attributes the activity to APT41 at medium confidence, citing a PDB path prefix C:\Users\xdd\Desktop shared with the kernel implant in ESET's June 2026 FishMonger/APT41 report (which also alluded to an unspecified UEFI bootkit component), the recurring 'xdd' identifier across BlackX payloads, the sideload-plus-encrypted-file pattern and OLLVM use common among Chinese-speaking actors. Kaspersky observed the activity against diplomatic targets in Central Asia; dates of the underlying operations are given only as 'early 2026'. Note that CVE-2023-24932 (the related BlackLotus mitigation) is only referenced as possibly related to the ESET report and is not listed as exploited here.
MITRE ATT&CK techniques used in TL-2026-4118
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1542.003 Bootkit; T1574.001 DLL
Discovery
T1082 System Information Discovery
Command and Control
T1102.002 Bidirectional Communication
Persistence
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Exfiltration
Affected products and versions in APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
- Microsoft — Windows (10, 11, 8.1) and Windows Server 2012-2022
Vulnerable versions: Windows 10 1507-21H2; Windows 11; Windows 8.1; Windows Server 2012-2022 without the Baton Drop mitigation manually activated
Fixed in: Systems with Microsoft Secure Boot mitigations deployed and manually activated per KB5025885
Remediation for APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
Patches
- Install the Microsoft updates for CVE-2022-21894 and manually activate the Secure Boot mitigation (registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and the Secure-Boot-Update scheduled task) per Microsoft KB5025885
- Revoke/blocklist the 'Windows Production PCA 2011' certificate proactively rather than waiting for certificate expiry on 2026-10-19
Immediate actions
- Hunt for inst.exe in C:\ProgramData\Intel, extensionless RC4 container PVMDIJGKAX2, and googleupdate.exe/jcef_helper.exe with v8_context_snapshot.bin outside legitimate application directories
- Block and alert on DNS/HTTP traffic to archivetj.com
- Audit for unexpected Machine Owner Key (MOK) enrollments and unexpected files on the EFI System Partition
- Alert on kernel drivers signed with certificate serial 0bcdf5e0da32d68900b8b7638459d072 and on anomalous ETW provider or kernel callback modification
Workarounds
- Where the mitigation cannot yet be enforced, restrict local administrator rights and add DBX revocations after testing on representative devices
Longer-term hardening
- Monitor cloud-storage API access (Google Drive, OneDrive, Yandex.Disk) from endpoints that have no business need for it
- Deploy exploit prevention and EDR with boot-chain/firmware integrity visibility
- Enable Secure Boot with BitLocker and measured-boot attestation, and monitor ESP file integrity
CVEs associated with APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
Weaknesses (CWE) in APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
Timeline of APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
- CVE-2022-21894 (Baton Drop, Secure Boot security feature bypass) published and patched by Microsoft; the mitigation was not enforced automatically.
- BlackLotus UEFI bootkit advertised on a hacking forum for about USD 5,000 (month-level date per Securelist/ESET reporting).
- ESET publicly confirms BlackLotus can bypass Secure Boot on fully patched Windows via CVE-2022-21894.
- Microsoft KB5025885 Deployment Phase begins: updates available with manual activation of boot manager revocations.
- BlackX bootkit activity against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan (reported only as 'early 2026'; month-start used as placeholder).
- ESET publishes FishMonger/APT41 report describing a kernel implant with a PDB path starting C:\Users\xdd\Desktop and an unspecified UEFI bootkit component (month-level date).
- 'Windows Production PCA 2011' certificate expires, but automatic blocklisting/enforcement is not in place.
- Kaspersky Securelist publishes analysis of BlackX and attributes it to APT41 at medium confidence.
Sources cited for APT41 BlackX UEFI bootkit (BlackLotus-derived) targets
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
- NVD - CVE-2022-21894
- MSRC - CVE-2022-21894 Secure Boot Security Feature Bypass Vulnerability
- KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
- CISA Known Exploited Vulnerabilities Catalog
- BlackLotus UEFI bootkit disables Windows security mechanisms (Help Net Security)
- BlackLotus bootkit bypasses UEFI Secure Boot on patched Windows 11 (BleepingComputer)
- Enter the BlackLotus: analysis of the latest UEFI bootkit (SOCRadar)
Detection coverage for TL-2026-4118
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4118 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.