Actor Profile

APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign. The group is known for dual-mission operations encompassing both espionage and financially motivated intrusions. In this campaign, APT41 targeted diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, deploying a sophisticated UEFI bootkit to achieve long-term covert access and undermine Windows startup defenses. The group's motivation centers on strategic intelligence collection from government and diplomatic entities in Central Asia, consistent with Chinese state interests in the region.

TTPs (Tactics, Techniques, Procedures)

APT41 leveraged T1542.003 (Pre-OS Boot: Bootkit) by deploying BlackX, a UEFI bootkit exploiting CVE-2022-21894 (Baton Drop) to bypass Secure Boot on systems lacking manual certificate revocations. The bootkit installer (inst.exe) used T1027.002 (Obfuscated Files or Information: Software Packing) with RC4 encryption. Post-exploitation TTPs include T1014 (Rootkit) via kernel driver injection signed with a stolen certificate from Wenjiang District Mingyu Network Technology Service Studio, T1562.001 (Impair Defenses: Disable or Modify Tools) targeting Kaspersky and Avast security products, and T1543.003 (Create or Modify System Process: Windows Service) for persistence. C2 infrastructure employed T1071.002 (Application Layer Protocol: File Transfer Protocols) using Google Drive, OneDrive, and Yandex.Disk for blending with legitimate traffic. Additional techniques include T1059.001 (Command and Scripting Interpreter: PowerShell), T1078 (Valid Accounts), T1082 (System Information Discovery), and T1553.002 (Subvert Trust Controls: Code Signing). The campaign delivered SprySOCKS backdoor and OxiDLLRunner payloads for espionage operations.

Targets & Patterns

APT41 specifically targeted diplomatic organizations in Central Asian nations—Tajikistan, Uzbekistan, and Turkmenistan—during early 2026. The targeting pattern reflects strategic intelligence priorities aligned with Chinese state interests in Central Asia, a region of geopolitical significance for Belt and Road Initiative infrastructure and regional influence. The selection of diplomatic entities suggests objectives centered on policy intelligence, negotiation strategies, and regional political dynamics. This campaign represents a geographic expansion from APT41's historical targeting, which has included government entities in Taiwan, Thailand, Pakistan, and Honduras. The focus on diplomacy sector enables collection of sensitive communications, bilateral agreements, and strategic assessments that support Chinese foreign policy decision-making.

Historical Context

BlackX represents an evolution from BlackLotus, a UEFI bootkit first advertised on cybercrime forums in late 2022 and documented by ESET in March 2023. The BlackLotus source code has never been publicly released, indicating APT41 either reverse-engineered the bootkit or acquired it through underground channels—a rare instance of APT actors borrowing from cybercrime tooling. APT41's use of UEFI bootkits builds on ESET's June 2026 reporting that FishMonger (Aquatic Panda, Earth Lusca)—a cluster operating under the APT41 umbrella—deployed SprySOCKS backdoor with potential UEFI bootkit components exploiting CVE-2023-24932 against government targets in Honduras, Taiwan, Thailand, and Pakistan between 2023-2024. The group's known malware arsenal includes ASPXSpy, PlugX, gh0st RAT, ZxShell, KEYPLUG, LightSpy, DUSTPAN, China Chopper, ShadowPad, and MESSAGETAP, demonstrating sustained investment in diverse persistence mechanisms.

Defensive Recommendations

  • Apply Microsoft Secure Boot revocation mitigations by manually adding 'Windows Production PCA 2011' certificate to the UEFI Forbidden List (DBX) to block CVE-2022-21894 exploitation, as patching alone is insufficient
  • Monitor for suspicious UEFI partition modifications and unsigned or anomalously signed EFI binaries, particularly those attempting to install Machine Owner Keys (MOK) via T1542.003
  • Detect T1027.002 obfuscated installer execution patterns, specifically command-line invocations of executables in C:\ProgramData with extensionless encrypted files and RC4 decryption keys
  • Implement behavioral detection for T1071.002 abuse of legitimate cloud storage services (Google Drive, OneDrive, Yandex.Disk) as C2 channels, focusing on unusual API call patterns from system processes
  • Revoke and block certificates issued to Wenjiang District Mingyu Network Technology Service Studio and monitor for T1553.002 code signing abuse via certificate theft or procurement from Chinese certificate authorities

---

# Geopolitical Context

Geopolitical Context

The deployment of the BlackX UEFI bootkit against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan represents a sophisticated intelligence collection operation consistent with China's strategic interests in Central Asia. The targeting of diplomatic entities in these three former Soviet republics—all participants in China's Belt and Road Initiative—suggests intelligence priorities focused on understanding regional diplomatic posture, bilateral relations, and potential policy shifts affecting Chinese economic and security interests in the region. The operation's technical sophistication, including the apparent reverse-engineering or acquisition of BlackLotus source code from cybercrime actors, indicates a willingness by state-sponsored groups to leverage criminal innovation for strategic intelligence purposes. This blurring of lines between APT and cybercrime ecosystems represents an evolving threat model where state actors opportunistically adopt tools and techniques from the criminal underground when they provide operational advantage.

State Actor Alignment

The campaign is attributed by Kaspersky to APT41, a China-linked state-sponsored threat group with a documented history of targeting government and diplomatic sectors across Asia and beyond. APT41 operates multiple sub-clusters including FishMonger (also tracked as Aquatic Panda and Earth Lusca), which ESET previously linked to SprySOCKS backdoor deployments against government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. The group's use of a sophisticated UEFI bootkit exploiting CVE-2022-21894 (Baton Drop)—a vulnerability requiring either administrator privileges or physical access—indicates the operation occurred after initial compromise through unspecified vectors. The malware's design to evade detection by specifically targeting Kaspersky and Avast security products, combined with the use of legitimate cloud services (Google Drive, OneDrive, Yandex.Disk) for command-and-control, reflects operational security practices consistent with state-sponsored intelligence collection rather than financially motivated cybercrime.

Business Impacty pro region

The targeting of diplomatic organizations in three Central Asian republics carries significant implications for regional security and information integrity. For the affected states—Tajikistan, Uzbekistan, and Turkmenistan—the compromise of diplomatic communications and systems could expose sensitive negotiations, policy deliberations, and bilateral relationships to foreign intelligence services. This creates asymmetric information advantages for the attacker and may undermine the diplomatic sovereignty of smaller states with limited cybersecurity capacity. For Europe, the operation underscores the vulnerability of partner nations in Central Asia to sophisticated cyber espionage, potentially complicating EU and NATO engagement strategies in the region. The campaign also highlights the global challenge of UEFI-level threats that bypass traditional security controls, requiring coordinated international response including certificate revocation enforcement and supply chain security measures. The use of cloud services operated by Western and Russian companies (Google, Microsoft, Yandex) for C2 infrastructure demonstrates how legitimate global digital infrastructure can be weaponized, complicating attribution and interdiction efforts across jurisdictions.

Forecast

If organizations continue to neglect manual Secure Boot revocation procedures—particularly the addition of vulnerable certificates to the UEFI Forbidden List (DBX)—exploitation of CVE-2022-21894 and similar Secure Boot bypass vulnerabilities is likely to persist despite patch availability. The expiration of the "Windows Production PCA 2011" certificate on October 19, 2026, without widespread blocklisting, may create an extended window of vulnerability that APT41 and other sophisticated actors will likely continue to exploit. If the BlackX source code or techniques proliferate beyond APT41—either through intelligence sharing among state actors or leakage to cybercrime forums—UEFI bootkit attacks may become more common across both espionage and criminal campaigns. For Central Asian diplomatic targets, if current compromise remains undetected, long-term covert access could enable sustained intelligence collection on regional diplomatic initiatives, potentially influencing negotiations and policy decisions. If Western security vendors and Microsoft enhance detection capabilities for UEFI-level persistence and improve guidance on revocation procedures, the operational lifespan of BlackX may be limited, though firmware-level threats will likely remain a persistent challenge requiring hardware-level security improvements in future system deployments.