New BlackX UEFI Bootkit Exploiting Baton Drop
New BlackX UEFI Bootkit Exploiting Baton Drop
In early 2026, we discovered a malware sample similar to BlackLotus that was used in an APT campaign in Central Asia. We dubbed this UEFI bootkit BlackX. This complex APT attack targeted diplomatic agencies in Central Asian countries – namely Tajikistan, Uzbekistan, and Turkmenistan. Attackers deployed BlackX after compromising victim machine networks and obtaining administrator privileges.
To install the bootkit, attackers dropped inst.exe, an installer, and PVMDIJGKAX2, an RC4-encrypted file. The installer was launched with the command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. This package drops files to system and UEFI partitions to exploit the Baton Drop vulnerability (CVE-2022-21894). The exploit implementation is remarkably similar to BlackLotus, aiming to install custom Machine Owner Keys (MOK) to load arbitrary EFI files and manipulate Secure Boot. The UEFI payload then injects a malicious driver into the Windows kernel. This driver differs from BlackLotus’s and is signed with a revoked certificate (0bcdf5e0da32d68900b8b7638459d072) for 温江区明宇网络技术服务工作室 (Wenjiang District Mingyu Network Technology Service Studio).
Apart from tampering with security solutions, the driver also deploys a user-mode payload for cyberespionage. One such payload is a RAT that uses cloud storage for C2 server communications – we observed its versions using Google Drive, OneDrive, and Yandex.Disk. Another payload delivered through the bootkit, which we dubbed OxiDLLRunner, is a malicious DLL obfuscated with OLLVM. It is loaded by the legitimate file googleupdate.exe (original filename: jcef_helper.exe, MD5: AF8A983B9ADA07EAE1259BF2953ABD40), also delivered by the bootkit. The decrypted data starts with shellcode followed by a PE file, which is a Rust payload designed to communicate with the www[.]archivetj[.]com C2 server.
Based on the following facts, we have attributed this attack to the APT41 threat actor with medium confidence: In June 2026, ESET published a blog post on attacks by the FishMonger threat actor, assumed to be related to APT41. This post describes a kernel implant with a PDB path starting with C:\Users\xdd\Desktop. We observed the identifier “xdd” used multiple times in the BlackX bootkit payloads. Additionally, BlackX payloads are loaded using a legitimate executable abused via DLL sideloading and an encrypted file – a pattern common among Chinese-speaking threat actors. The OxiDLLRunner file has been obfuscated with OLLVM, an obfuscator commonly used by Chinese-speaking actors.
The targeted machines were fully patched for the Baton Drop vulnerability. However, the problem was with the patch itself. The patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components. This revocation does not happen automatically upon patch installation – the user has to trigger it manually. This is done with a registry flag set inside HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot and a scheduled task named Secure-Boot-Update created. These instructions for activating the patch are hard for an average IT administrator to notice. It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch.