// AI threat desk · 24 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighUEFICVSS 4.4

BlackX UEFI bootkit targeted Central Asian diplomatic agencies

BlackX targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026, Kaspersky said in a report published Oct 22, 2026.

· 1 min read
AI-generated image of security analysts examining blurred firmware diagnostics and incident-monitoring screens in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • BlackX targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026.
  • The bootkit used custom Machine Owner Keys to load arbitrary EFI files and manipulate Secure Boot.
  • Kaspersky attributed the campaign to APT41 with medium confidence.

BlackX targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026, Kaspersky said in a report published Oct 22, 2026.

Attackers deployed the UEFI bootkit after compromising victim networks and obtaining administrator privileges. The exploit aims to install custom Machine Owner Keys, which allow loading arbitrary EFI files to manipulate Secure Boot.

UEFI typically runs before the operating system or other programs load. Kaspersky attributed the campaign to APT41 with medium confidence.

On this page

BlackX exploited Baton Drop to load its bootkit

The installer package drops files to system and UEFI partitions, designed to exploit the Baton Drop vulnerability. The package included an installer named inst.exe and an RC4-encrypted file named PVMDIJGKAX2.

The Hacker News said the related BlackLotus vulnerability has a CVSS score of 4.4.

Kaspersky said the problem was with the patch itself

Kaspersky said the targeted machines were fully patched, but the problem was with the patch itself. The certificate expired on Oct 19, 2026, but this does not prevent vulnerable binaries from loading unless the certificate is blocklisted.

What to do now

  1. If a device is determined to have been infected with BlackLotus, remove it from the network and reformat both the OS and EFI partitions, or restore it from a known clean backup that includes the EFI partition.

FAQ

What happened in the BlackX campaign?

Kaspersky said BlackX targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026 after attackers compromised victim networks and obtained administrator privileges.

Who did Kaspersky link to the BlackX campaign?

Kaspersky attributed the attack to APT41 with medium confidence.

What vulnerability did BlackX exploit?

The Hacker News said the related BlackLotus vulnerability CVE-2022-21894, also known as Baton Drop, has a CVSS score of 4.4.

Sources

  1. Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign | Microsoft Security Blog, MicrosoftPrimary
  2. New BlackX UEFI bootkit exploiting Baton Drop, KasperskyPrimary
  3. BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations, The Hacker News
  4. UEFI, Wikipedia
How we checked this story
ClaimSourceStatus
Kaspersky reported that BlackX targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan in early 2026.KasperskyConfirmed
Kaspersky found that attackers deployed BlackX after compromising victim networks and obtaining administrator privileges.KasperskyConfirmed
The BlackX installer package dropped files to system and UEFI partitions to exploit the Baton Drop vulnerability.KasperskyConfirmed
BlackX used custom Machine Owner Keys to load arbitrary EFI files and manipulate Secure Boot.KasperskyConfirmed
The Hacker News said the related BlackLotus vulnerability CVE-2022-21894 has a CVSS score of 4.4.The Hacker NewsAttributed
Kaspersky attributed the attack to APT41 with medium confidence.KasperskyConfirmed
BlackX used an RC4-encrypted file named PVMDIJGKAX2 and an installer named inst.exe.KasperskyConfirmed
Researchers observed a remote access trojan using Google Drive, OneDrive, and Yandex.Disk for command-and-control communications.KasperskyConfirmed
Microsoft said the BlackLotus bootkit is a persistence and defense-evasion mechanism, not a first-stage payload or initial access vector.MicrosoftConfirmed
UEFI is a firmware architecture specification that typically runs before the operating system or other programs load.WikipediaConfirmed
Microsoft published its report on Apr 11, 2023.MicrosoftConfirmed
securelist.com published its report on Oct 22, 2026.securelist.comConfirmed

Could not verify

  • Whether BlackX was exploited using a newly assigned CVE is not established.
  • How many organizations or devices were affected is not established.
  • Whether APT41 operated the campaign is not independently established.
  • Whether the BlackX and FishMonger bootkit components are the same is not established.
apt
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok