BlackLotus

In early 2026, the APT41 threat actor revived techniques from the BlackLotus UEFI bootkit to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a new bootkit dubbed BlackX, exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by installing custom Machine Owner Keys (MOK). The attack involved a multi-stage payload, including a malicious kernel driver signed with a revoked certificate and user-mode implants such as a cloud-based RAT and a Rust-based C2 client communicating with www.archivetj.com.

The BlackX UEFI bootkit, attributed with medium confidence to Chinese state-sponsored threat group APT41 (also known as Brass Typhoon, Wicked Panda, Barium), has been used in an espionage campaign since early 2026 targeting diplomatic agencies in Central Asia. It exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by enrolling custom Machine Owner Keys (MOKs) and loading malicious EFI files, leveraging a previously known flaw that requires manual activation of certificate revocation to be fully mitigated. The bootkit deploys a malicious kernel driver signed with a revoked certificate to disable security processes, tamper with ETW, and deploy follow-on payloads including a RAT using cloud storage for C2 and the OxiDLLRunner DLL loader that executes obfuscated Rust-based plugins from a malicious domain.

A sophisticated UEFI bootkit named BlackX has been used to target diplomatic organizations in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan, in early 2026. The bootkit exploits the CVE-2022-21894 vulnerability (Baton Drop) to bypass Secure Boot, even on patched systems that have not applied manual revocation updates. The attack is attributed to the China-linked APT41 group, leveraging techniques similar to the BlackLotus bootkit. The malware installs a malicious driver signed with a revoked certificate and deploys espionage payloads, including a .NET-based remote access trojan and a Rust-based DLL sideloaded via googleupdate.exe that communicates with 'archivetj[.]com'.

Cybersecurity researchers have identified 11 outdated, Microsoft-signed UEFI shim bootloaders that can be exploited to bypass Secure Boot protections on UEFI-based systems. These vulnerable shims allow attackers to execute arbitrary code during the early boot phase, enabling deployment of persistent UEFI bootkits such as Bootkitty and BlackLotus. Although the Microsoft Corporation UEFI CA 2011 certificate expired in June 2026, affected systems remain at risk if the vulnerable shims are not explicitly revoked via hash. The issue highlights a supply chain exposure where outdated but still-trusted bootloaders undermine critical firmware security mechanisms.