A new bootkit called BlackX is hitting diplomats, and it slips past Secure Boot
Suspected China-linked hackers are using a flaw first abused by BlackLotus to plant malware that loads before Windows even starts.
Key points
- Researchers at Kaspersky say a new UEFI bootkit called BlackX was used against diplomatic offices in Tajikistan, Uzbekistan and Turkmenistan in early 2026, and point the finger at the China-linked group APT41.
- The malware abuses CVE-2022-21894, a Secure Boot bypass that Microsoft patched in January 2022 but that still works on machines missing the revocation updates.
- Microsoft's own guidance on the earlier BlackLotus campaign stresses that this class of attack is a persistence trick, not a way in: the attackers already have admin or physical access before they plant it.
- Once installed, the bootkit runs before Windows loads and can switch off BitLocker, HVCI and Microsoft Defender, making normal antivirus blind to it.
- The fix is unglamorous: apply the Secure Boot revocation list Microsoft shipped in 2023, not just the original 2022 patch.
A new piece of malware named BlackX is being used to spy on diplomats in Central Asia, and it has a nasty trick. It loads before Windows does.
Kaspersky, first reported by The Hacker News, says the campaign hit foreign ministries and related offices in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The researchers tie the activity to APT41, a hacking crew long linked to the Chinese state.
BlackX is what security people call a UEFI bootkit. UEFI is the small piece of software that wakes your computer up and hands control to Windows. A bootkit buries itself in that handover. By the time Windows and its defences are running, the malicious code is already in charge.
How does it get past Secure Boot?
It uses an old flaw, CVE-2022-21894, nicknamed Baton Drop. Microsoft patched the hole in January 2022. The catch is that patching the bug is not enough. The vulnerable boot files are still trusted unless the machine also loads an updated revocation list, which tells it to refuse them. Plenty of machines never got that second step.
Secure Boot is the feature that is supposed to make sure only trusted software runs at startup. Baton Drop lets an attacker smuggle in an older, signed-but-broken boot file and ride it straight through that check.
This is the same door the BlackLotus bootkit kicked open in 2023. In its guidance on the BlackLotus campaign, Microsoft was blunt about two things. The bootkit is not how attackers break in. They need admin rights or hands on the machine first. And once it is planted, it can quietly disable BitLocker disk encryption, HVCI memory protection and Microsoft Defender Antivirus, which is why investigators often miss it.
Who is being targeted?
Diplomatic staff in three Central Asian countries, according to Kaspersky's write-up. The targeting fits a long pattern for APT41, which has mixed state espionage with for-profit crime for more than a decade. Nothing in the current reporting suggests ordinary consumers or businesses outside that diplomatic circle are in scope.
That said, the technique is the story. BlackLotus source code leaked publicly in 2023. BlackX shows that other crews are still building on it, and still finding Windows machines where the revocation never landed.
Key facts
| Item | Detail |
|---|---|
| Malware | BlackX UEFI bootkit |
| Suspected operator | APT41 (China-linked) |
| Targets | Diplomatic entities in Tajikistan, Uzbekistan, Turkmenistan |
| Timing | Early 2026 |
| Flaw abused | CVE-2022-21894 (Baton Drop) |
| Original patch | January 2022; revocation update 2023 |
What should a normal person do?
For most readers, honestly, very little. This is not something that arrives in a phishing email on your home laptop. It is planted by attackers who already own the machine.
If you run IT for an organisation that could plausibly interest a state spy agency, the job is specific: install the Secure Boot revocations Microsoft published in 2023, confirm BitLocker and Defender are actually on, and check boot partitions for the file-system oddities Microsoft listed in its BlackLotus hunting guide. Multi-factor authentication would not have stopped this one, because the attackers were already past the login. The weak link here is unpatched firmware trust, not a stolen password.
My read: the interesting detail is not that APT41 built another bootkit. It is that a four-year-old Secure Boot bypass still works in the field, because the fix was split into two steps and plenty of fleets only did the first.
