BLACKXBlackX

BlackX is a UEFI bootkit reported by Kaspersky GReAT, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Not to be confused with the unrelated 'black x' ransomware entry (misp-galaxy:ransomware="black x"), which only shares the name. It is deployed after the network is compromised and administrator rights are obtained: an installer (inst.exe) decrypts an RC4-encrypted package whose key is passed on the command line. It exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys and bypass Secure Boot. Its exploit implementation is very close to BlackLotus but differs from it, which suggests the BlackLotus code was reverse-engineered or bought, since it was never published. Fully patched machines were still infected because the 'Windows Production PCA 2011' certificate revocation that the patch relies on must be enabled manually. The UEFI payload injects a kernel driver signed with a since-revoked certificate. The driver tampers with security products (callbacks, ETW, with routines aimed at Kaspersky and Avast), protects the bootkit files and deploys user-mode payloads: a .NET-capable RAT using Google Drive, OneDrive or Yandex.Disk for C2, and the OxiDLLRunner loader. Kaspersky attributes the campaign to APT41 with medium confidence, based on the 'xdd' identifier shared with a FishMonger kernel implant documented by ESET, which mentioned an unspecified UEFI bootkit, and on typical Chinese-speaking tradecraft (DLL sideloading, OLLVM).