APT41 deploys BlackX UEFI bootkit, a BlackLotus copycat exploiting Baton Drop, against Central Asian diplomatic agencies

Linha do tempo

1. thehackernews.com ↗ · pub. 23/10/2026 15:50 · coletado 23/10 17:00

   APT41-linked BlackX UEFI bootkit, a BlackLotus copycat, bypasses Secure Boot at Central Asian diplomatic entities

   The article adds detail on the FishMonger link: aliases Aquatic Panda and Earth Lusca, the SprySOCKS backdoor, and ESET's 2023-2024 victims in Honduras, Taiwan, Thailand and Pakistan. It also cites Microsoft's earlier statement that BlackLotus is a persistence and defense evasion mechanism and not an initial access vector, and Kaspersky's remark that APT actors rarely borrow code from cybercrime actors.

   ler a análise desta fonte ocultar

   The article adds detail on the FishMonger link: aliases Aquatic Panda and Earth Lusca, the SprySOCKS backdoor, and ESET's 2023-2024 victims in Honduras, Taiwan, Thailand and Pakistan. It also cites Microsoft's earlier statement that BlackLotus is a persistence and defense evasion mechanism and not an initial access vector, and Kaspersky's remark that APT actors rarely borrow code from cybercrime actors.

   Kaspersky reports that diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan were targeted in early 2026 with BlackX, a new UEFI bootkit suspected to be operated by the China-linked APT41. BlackX is assessed to be an updated copycat of BlackLotus and abuses the Secure Boot bypass Baton Drop (CVE-2022-21894). Systems that have the patch installed remain exposed when organizations skip the manual Secure Boot revocation steps, in particular blocklisting the "Windows Production PCA 2011" certificate in the DBX. The bootkit gives persistence and defense evasion, and it delivers a kernel driver that tampers with security products plus cyber-espionage payloads. The BlackLotus source code was never public, so the authors either reverse-engineered it or bought the code.

   Technical Details

   • Attackers first breach the network through an unspecified method and gain administrator privileges, then drop inst.exe and the encrypted file PVMDIJGKAX2. The installer runs as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1, where the last argument is the RC4 key.
   • The installer writes files to the system and UEFI partitions to exploit CVE-2022-21894 in a way "remarkably similar" to BlackLotus, and enrolls Machine Owner Keys (MOK) to load arbitrary EFI files.
   • The UEFI payload injects a kernel driver signed with a certificate of Wenjiang District Mingyu Network Technology Service Studio, since revoked. The driver tampers with endpoint security software; some routines run only when Kaspersky or Avast products are present, but Kaspersky found them ineffective.
   • Payload 1: a RAT that loads .NET payloads and uses Google Drive, OneDrive and Yandex.Disk for C2.
   • Payload 2: OxiDLLRunner, sideloaded by the legitimate googleupdate.exe. It launches a Rust payload that contacts archivetj[.]com to fetch DLL plugins.
   • The PCA 2011 certificate expired on 19 October 2026, but this does not stop vulnerable binaries from loading unless the certificate is blocklisted.
   • The APT41 link rests on an ESET June 2026 report on FishMonger (aka Aquatic Panda, Earth Lusca), which documented the SprySOCKS backdoor against government entities in Honduras, Taiwan, Thailand and Pakistan in 2023-2024, with limited indications of a UEFI bootkit component likely exploiting CVE-2023-24932. The "xdd" string overlap with FishMonger's kernel implant and the use of DLL sideloading support the link.

   Remediation

   • Installing the Baton Drop patch is not enough. Apply Microsoft's manual Secure Boot revocation mitigations, including adding "Windows Production PCA 2011" to the DBX.
   • Hunt for the listed file names, the RC4-key command line and the C2 domain.
2. gbhackers.com ↗ · pub. 23/10/2026 05:36 · coletado 23/10 07:00

   APT41-linked BlackX UEFI bootkit bypasses Secure Boot at Central Asian diplomatic organizations via Baton Drop

   The article adds background on BlackLotus (sold for $5,000 in October 2022, confirmed by ESET in March 2023) and stresses operational cautions for remediation: revocations applied before trusted replacement components are ready can prevent systems from booting, so recovery media must be updated and boot compatibility tested in a staged rollout.

   ler a análise desta fonte ocultar

   The article adds background on BlackLotus (sold for $5,000 in October 2022, confirmed by ESET in March 2023) and stresses operational cautions for remediation: revocations applied before trusted replacement components are ready can prevent systems from booting, so recovery media must be updated and boot compatibility tested in a staged rollout.

   Suspected Chinese APT41 operators have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky discovered the campaign in early 2026 and attributes it to APT41 with medium confidence. BlackX closely resembles BlackLotus, which was sold on underground forums for $5,000 in October 2022, and abuses Baton Drop (CVE-2022-21894) to bypass Secure Boot. Even fully patched systems stay exposed unless administrators have explicitly enabled bootloader revocations.

   Technical Details

   • The attackers deploy BlackX after compromising the network and gaining administrator privileges. The installer inst.exe runs with an RC4-encrypted, extensionless container, PVMDIJGKAX2, and the key Q46F6MDLI3RX2KV1. Keeping the components outside the executable complicates analysis when responders recover only the installer.
   • The installer places components on the Windows and EFI partitions, then exploits Baton Drop to enroll attacker-controlled Machine Owner Keys, which allow malicious EFI applications to load.
   • Kaspersky sees substantial similarities to BlackLotus alongside implementation differences. This suggests reverse engineering or access to the source code, not a confirmed development relationship.
   • The kernel driver is signed with a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio, since revoked. It disables process, thread and registry callbacks, interferes with ETW providers, and redirects attempts to open bootkit files toward calc.exe. Its product-specific tampering routines failed against Kaspersky software in testing.
   • User-mode payload 1 is a RAT that uses Google Drive, OneDrive or Yandex.Disk for C2. File suffixes identify instructions and results, supporting .NET execution, file transfers and system-information reporting.
   • User-mode payload 2, OxiDLLRunner, uses OLLVM obfuscation and DLL sideloading through a legitimate executable renamed googleupdate.exe. It decrypts v8_context_snapshot.bin into shellcode and a Rust payload that communicates with www[.]archivetj[.]com. Downloaded DLL plugins export create_plugin and run in separate threads.
   • Attribution partly rests on the identifier "xdd", also present in a driver development path in ESET's June 2026 FishMonger research. ESET noted an unspecified bootkit possibly exploiting CVE-2023-24932; the link to BlackX is inferential.
   • The root weakness is incomplete revocation, not missing patches. Microsoft's mitigations are not enabled by default and require updating the Secure Boot databases and revoking Windows Production PCA 2011 through the DBX. That certificate expired on October 19, 2026, but expiration alone does not block vulnerable binaries.

   Remediation

   • Validate revocation status and follow Microsoft's staged deployment guidance.
   • Update recovery media and test boot compatibility.
   • Applying revocations without first preparing trusted replacement components can leave systems unable to boot, so use a controlled rollout with verification.
3. securelist.com ↗ · pub. 22/10/2026 03:00 · coletado 22/10 04:00 primeiro registro

   APT41 deploys BlackX UEFI bootkit, a BlackLotus copycat exploiting Baton Drop, against Central Asian diplomatic agencies

   ler a análise desta fonte ocultar

   Kaspersky GReAT identified an APT campaign in early 2026 targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The attackers used a UEFI bootkit dubbed BlackX, which closely resembles BlackLotus and bypasses Secure Boot by exploiting Baton Drop (CVE-2022-21894). Kaspersky attributes the activity to APT41 with medium confidence. The targeted machines were fully patched, because the Baton Drop fix requires manual steps to revoke the "Windows Production PCA 2011" certificate, and Microsoft's automatic "Enforcement Phase" has not been implemented. BlackX delivers a kernel driver that tampers with security products, followed by cyberespionage payloads: a cloud-storage-based RAT and a Rust implant loaded via OxiDLLRunner.

   Technical Details

   • Attackers deploy BlackX after compromising the network and obtaining administrator privileges. They drop inst.exe (a clean installer with no embedded blobs) and PVMDIJGKAX2, an RC4-encrypted file holding all installation components. The launch command is C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1, where the last argument is the RC4 key.
   • The installer writes files to the system and UEFI partitions to exploit Baton Drop and enroll custom Machine Owner Keys (MOK), allowing arbitrary EFI files to load. The exploit is very similar to BlackLotus's but not identical. The BlackLotus source code was never published, so the authors either reverse-engineered it or obtained the source.
   • The UEFI payload injects a kernel driver signed with a certificate issued to 温江区明宇网络技术服务工作室 (serial 0bcdf5e0da32d68900b8b7638459d072), since revoked. The driver disables process, thread and registry callbacks, tampers with ETW providers, and includes routines aimed at Kaspersky and Avast that proved ineffective against Kaspersky products. It also redirects kernel open requests for bootkit files to a handle for calc.exe.
   • User-mode payload 1: a RAT that loads further .NET payloads and uses Google Drive, OneDrive or Yandex.Disk for C2, interpreting files by suffix.
   • User-mode payload 2: OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by the legitimate googleupdate.exe (original name jcef_helper.exe, MD5 AF8A983B9ADA07EAE1259BF2953ABD40). It decrypts v8_context_snapshot.bin into shellcode plus a Rust PE that talks to www[.]archivetj[.]com and runs received DLLs exporting create_plugin in separate threads.
   • Attribution to APT41 (medium confidence) rests on: the "xdd" identifier in BlackX payloads matching the PDB path C:\Users\xdd\Desktop in ESET's June 2026 FishMonger report (FishMonger is assumed related to APT41), which mentioned an unspecified UEFI bootkit possibly exploiting CVE-2023-24932; DLL sideloading with an encrypted file; and OLLVM use.
   • The Baton Drop patch requires setting a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and creating a scheduled task Secure-Boot-Update. The "Windows Production PCA 2011" certificate expired on 19 October 2026, but this does not stop vulnerable binaries from loading unless the certificate is blocklisted.

   Remediation

   • Do not treat installing the Baton Drop update as sufficient. Complete the manual activation steps (registry flag and Secure-Boot-Update task) so the "Windows Production PCA 2011" certificate is revoked, accounting for dual-boot systems.
   • Deploy security solutions with exploit prevention on all machines and monitor their alerts.
   • Hunt for the listed file names, the RC4-key command line, the revoked certificate serial and the C2 domain.