A newly documented UEFI bootkit named BlackX has been deployed in cyberespionage operations targeting diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. By inserting malicious code into the earliest stages of a computer’s startup sequence, the operators can establish persistence before Windows and many endpoint defenses begin running.

The campaign is especially notable because compromised machines had received Windows updates. Researchers found that a separate Secure Boot revocation step had not been fully applied, leaving older, vulnerable boot components trusted by firmware. The finding is a sharp reminder that an operating system displaying an up-to-date status does not necessarily mean every firmware-level defense is enforced.

BlackX reaches below the operating system

BlackX abuses Baton Drop, the name given to CVE-2022-21894, to load attacker-controlled EFI files and interfere with Secure Boot. Its architecture shares elements with the earlier BlackLotus bootkit. EFI applications execute before the Windows kernel, giving a successful implant an opportunity to shape the environment in which the operating system and security products subsequently run.

The attackers first need access to the victim’s network and administrator privileges. A program called inst.exe then works with an encrypted file named PVMDIJGKAX2 to install the required components. Separating and encrypting those elements can complicate forensic recovery because responders who acquire only the installer may not capture the entire toolset.

Once active, BlackX uses a kernel driver to weaken visibility and protection. Researchers say it interferes with process, thread and registry callbacks, as well as Event Tracing for Windows. It also attempts to conceal malicious files by redirecting certain requests toward the legitimate Windows calculator process.

Espionage payloads use cloud services

The bootkit supports user-mode payloads built for surveillance and continued remote access. One remote-access Trojan can load additional .NET code and communicate through Google Drive, OneDrive or Yandex.Disk. Using familiar cloud platforms can help malicious traffic blend into services that organizations routinely permit.

A second component, labeled OxiDLLRunner by the researchers, decrypts a file called v8_context_snapshot.bin and launches a Rust payload. That code contacts a reported command-and-control domain. Analysts linked the wider activity to APT41 with medium confidence based on technical similarities and overlaps with previously observed operations; the confidence level means the attribution should be treated as an assessment, not established fact.

Why patches alone did not close the gap

Protection against Baton Drop depends on revoking trust in the Windows Production PCA 2011 certificate that signed vulnerable UEFI components. Installing Windows updates and applying the firmware revocation are related but distinct stages. Microsoft’s deployment process includes certificate and boot-manager changes as well as an update to the UEFI forbidden-signature database.

That staged approach exists for a reason. Blocking old boot components can make recovery media or alternative boot paths unusable, potentially leaving systems unable to start. Enterprises therefore need to test the changes, update recovery assets and confirm compatibility before broad enforcement. The certificate’s expiration alone does not stop already signed binaries from loading; the relevant trust must be explicitly revoked.

What defenders should verify

• Confirm Secure Boot is enabled and that required revocations are present in firmware.
• Test recovery media and update it before enforcing revocations fleet-wide.
• Hunt for suspicious administrative activity and unexplained changes to EFI partitions.
• Investigate tampering with ETW or endpoint security callbacks.
• Search for the installer names, paths and payload artifacts described in current intelligence.

Because BlackX installation follows an earlier privileged compromise, Secure Boot checks should accompany a broader intrusion investigation. Teams should identify how administrator access was obtained, rotate exposed credentials and look for lateral movement. Firmware protections form one layer of defense, but this campaign demonstrates that their real state must be measured rather than inferred from the Windows update screen.