BlackX Bootkit Targets Diplomatic Entities in Central Asia
The malware uses a known boot vulnerability to bypass security protocols and maintain long-term covert system persistence.
Updated on Oct. 23, 2026 in Cybersecurity
Live Poll
Do you feel confident that your computer's security settings are sufficient to block advanced digital threats?
In early 2026, hackers deployed a UEFI bootkit known as BlackX to target diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. This research-stage threat is an updated variant of the previously identified BlackLotus bootkit and functions as a persistence mechanism to maintain long-term, covert system access.
Why it matters
The deployment of BlackX highlights persistent risks to high-value targets that fail to apply manual Secure Boot revocation mitigations. By exploiting vulnerabilities in the boot process, the malware bypasses standard defenses to maintain deep, kernel-level presence on compromised hosts.
The BlackX bootkit carries a CVSS score of 4.4, utilizing a revoked certificate to sign its malicious driver. It requires administrator-level access to install Machine Owner Keys, allowing it to bypass Secure Boot by loading unauthorized EFI files.
The players
ESET
An international security software company specializing in endpoint protection and threat intelligence research.
APT41
A state-sponsored threat group known for cyber espionage and financially motivated attacks.
The details
BlackX functions as a persistence and defense evasion tool by infecting system and UEFI partitions to intercept the computer startup sequence. Attackers trigger the installation by executing a command-line argument containing an RC4 encryption key, a symmetric cipher used to obfuscate the payload. Once active, the bootkit leverages cloud services including Google Drive, OneDrive, and Yandex.Disk to manage command-and-control communications.
Timeline
Late 2022: BlackLotus first appears on cybercrime forums.
March 2023: ESET confirms the existence of BlackLotus.
Early 2026: BlackX targets diplomatic entities in Central Asia.
June 2026: ESET links FishMonger activity to APT41.
October 19, 2026: The Windows Production PCA 2011 certificate expires.
The Tech Race
BlackX marks an evolution of the BlackLotus bootkit, which first emerged in late 2022. It follows a pattern of high-stakes cyber espionage where attackers iterate on existing UEFI-level exploits to evade updated security protocols.
Organizations can defend against this threat by ensuring the Windows Production PCA 2011 certificate is added to the UEFI Forbidden List. Because installation requires administrative or physical access, strict physical security and restricted user privileges remain primary defense layers.
The takeaway
Security teams should audit their UEFI revocation lists to ensure they are protected against Baton Drop exploits. Monitoring for unauthorized command-and-control traffic to common cloud storage providers remains a critical detection step for identifying active persistence mechanisms.
Further reading
For broader trends in sophisticated endpoint threats, explore our coverage in Cybersecurity.
Live Poll
Do you feel confident that your computer's security settings are sufficient to block advanced digital threats?
