# APT41 BlackX UEFI bootkit (BlackLotus-derived) targets Central Asian diplomatic organizations via CVE-2022-21894 (Baton Drop)

> Securelist (Kaspersky) reports BlackX, a UEFI bootkit closely resembling BlackLotus, used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on fully patched systems where Microsoft's manually-activated mitigation was not enabled. Attribution to APT41 is assessed at medium confidence.

- **Published:** 2026-10-22T06:47:55Z
- **Last reviewed:** 2026-10-22T06:47:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4118
- **ID:** TL-2026-4118
- **Severity:** CRITICAL (CVSS 4.4)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT41 (China)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-21894, CVE-2023-24932

## Description

BlackX is a UEFI bootkit whose implementation Kaspersky describes as remarkably similar to BlackLotus, the bootkit first advertised on a hacking forum in October 2022 for about USD 5,000 and analyzed by ESET in March 2023. BlackX abuses Baton Drop (CVE-2022-21894), a Secure Boot security feature bypass in Windows boot components signed by the 'Windows Production PCA 2011' certificate. The Microsoft fix for this class of bug requires manual activation (a Secure Boot registry flag and the Secure-Boot-Update scheduled task) and the automatic revocation 'Enforcement Phase' had not been implemented as of the report, so fully patched systems remain exploitable. The bootkit installs custom Machine Owner Keys (MOK) so that arbitrary EFI binaries load under Secure Boot.

Deployment starts with a benign-looking installer, inst.exe, launched as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. PVMDIJGKAX2 is an extensionless RC4-encrypted container holding every bootkit component and the final argument is the RC4 key, so the installer carries no malicious strings. Components are written to the system and UEFI partitions. A kernel driver signed with a certificate issued to the Chinese entity 'Wenjiang District Mingyu Network Technology Service Studio' (serial 0bcdf5e0da32d68900b8b7638459d072, since revoked) tampers with process, thread and registry callbacks and with ETW providers to blind security products. It has routines aimed at Kaspersky and Avast that run only when those products are present (reported as ineffective), and it intercepts kernel file-open requests for the bootkit's files, returning a handle to calc.exe instead.

User-mode payloads include a RAT that loads .NET second-stage payloads and uses Google Drive, OneDrive and Yandex.Disk as C2, exchanging files distinguished by suffixes 0x01-0x06 and SSSR (initial system information); remote commands run through TEST.Class1.RunCMD. A second payload, OxiDLLRunner (OLLVM-obfuscated), is sideloaded by a legitimate jcef_helper.exe binary renamed googleupdate.exe, which decrypts the RC4-encrypted v8_context_snapshot.bin into shellcode followed by a Rust PE. It beacons to www.archivetj.com and executes plugin DLLs exporting create_plugin in separate threads.

Kaspersky attributes the activity to APT41 at medium confidence, citing a PDB path prefix C:\Users\xdd\Desktop shared with the kernel implant in ESET's June 2026 FishMonger/APT41 report (which also alluded to an unspecified UEFI bootkit component), the recurring 'xdd' identifier across BlackX payloads, the sideload-plus-encrypted-file pattern and OLLVM use common among Chinese-speaking actors. Kaspersky observed the activity against diplomatic targets in Central Asia; dates of the underlying operations are given only as 'early 2026'. Note that CVE-2023-24932 (the related BlackLotus mitigation) is only referenced as possibly related to the ESET report and is not listed as exploited here.

## MITRE ATT&CK

- T1542.003 Bootkit
- T1542.003 Bootkit
- T1553 Subvert Trust Controls
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1102.002 Bidirectional Communication
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia](https://securelist.com/uefi-bootkit-blackx/121539/)
- [NVD - CVE-2022-21894](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-21894)
- [MSRC - CVE-2022-21894 Secure Boot Security Feature Bypass Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21894)
- [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [BlackLotus UEFI bootkit disables Windows security mechanisms (Help Net Security)](https://www.helpnetsecurity.com/2023/03/02/blacklotus-uefi-bootkit-windows)
- [BlackLotus bootkit bypasses UEFI Secure Boot on patched Windows 11 (BleepingComputer)](https://www.bleepingcomputer.com/news/security/blacklotus-bootkit-bypasses-uefi-secure-boot-on-patched-windows-11/)
- [Enter the BlackLotus: analysis of the latest UEFI bootkit (SOCRadar)](https://socradar.io/blog/enter-the-blacklotus-analysis-of-the-latest-uefi-bootkit/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4118