Actor Profile

BlackX is a UEFI bootkit malware family deployed in an espionage campaign in early 2026. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium. The bootkit appears to be derived from BlackLotus, either through reverse-engineering or access to its source code. BlackX contains code present in BlackLotus samples but missing from the publicly leaked BlackLotus repository (July 2023), suggesting the operator obtained proprietary code through purchase or advanced reverse-engineering rather than relying solely on the incomplete public leak.

TTPs (Tactics, Techniques, Procedures)

BlackX exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot protections by enrolling custom Machine Owner Keys (MOKs) and loading arbitrary EFI files. The bootkit deploys a malicious kernel driver signed with a revoked certificate (issued to Wenjiang District Mingyu Network Technology Service Studio) that disables security callbacks, tampers with Event Tracing for Windows (ETW) providers, and specifically targets Kaspersky and Avast security products. The driver intercepts file access requests to protect bootkit files by launching Windows Calculator instead. Follow-on payloads include a RAT using cloud storage services (Google Drive, OneDrive, Yandex.Disk) for C2 communications, and OxiDLLRunner, an OLLVM-obfuscated DLL that sideloads via googleupdate.exe to retrieve and execute Rust-based plugins from attacker infrastructure. Key MITRE ATT&CK techniques include T1542.003 (Pre-OS Boot: Bootkit), T1553.006 (Subvert Trust Controls: Code Signing Policy Modification), T1562.001 (Impair Defenses: Disable or Modify Tools), T1562.006 (Impair Defenses: Indicator Blocking), and T1102 (Web Service for C2).

Targets & Patterns

The campaign targeted diplomatic agencies in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. The focus on diplomatic entities aligns with APT41's historical espionage objectives and Chinese state interests in Central Asian geopolitical intelligence. The targeting pattern suggests intelligence collection priorities related to regional diplomatic activities and government operations. All identified victims were running fully patched Windows systems but had not manually activated additional Secure Boot revocations required to fully mitigate CVE-2022-21894, indicating the attacker specifically selected targets vulnerable to this mitigation gap.

Historical Context

BlackX demonstrates significant code overlap with BlackLotus, a UEFI bootkit that circulated on hacker forums since October 2022 and was confirmed by ESET in March 2023 to exploit Baton Drop (CVE-2022-21894) against fully patched Windows 11 systems. Kaspersky researchers assessed the Baton Drop exploitation implementation in BlackX as "remarkably similar" to BlackLotus. However, BlackX deploys different kernel drivers and payloads. The presence of code in BlackX that exists in BlackLotus samples but was absent from the incomplete July 2023 source code leak suggests either direct access to proprietary BlackLotus code or sophisticated reverse-engineering. This represents an evolution in UEFI bootkit threats, with actors adapting proven techniques from previous malware families. The medium-confidence attribution to APT41 links this activity to a prolific Chinese APT group known for both espionage and financially motivated operations since at least 2012.

Defensive Recommendations

  • Manually activate Secure Boot revocations for CVE-2022-21894 (Baton Drop) following Microsoft guidance, as patch installation alone does not automatically revoke vulnerable certificates
  • Add the 'Windows Production PCA 2011' certificate to blocklists to prevent vulnerable binaries from loading, even after its October 19, 2026 expiration date
  • Monitor for suspicious kernel driver loads signed with revoked certificates, particularly those issued to Chinese entities like Wenjiang District Mingyu Network Technology Service Studio
  • Detect anomalous ETW provider tampering and disabled security callbacks (T1562.001, T1562.006) through kernel-level monitoring and integrity checks
  • Implement network monitoring for C2 communications via cloud storage services (Google Drive, OneDrive, Yandex.Disk) using T1102 detection logic, focusing on unusual API patterns from system processes
  • Deploy UEFI firmware integrity monitoring to detect bootkit persistence mechanisms (T1542.003) and validate Secure Boot configuration state
  • Investigate unexpected googleupdate.exe process behavior and DLL sideloading activity, particularly OLLVM-obfuscated payloads decrypting v8_context_snapshot.bin files