Skip to content
New BlackX UEFI Bootkit Targets Central Asian Diplomatic Agencies

New BlackX UEFI Bootkit Targets Central Asian Diplomatic Agencies

First seen 22 Oct 2026, 15:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 16:14 UTC
  • •BlackX bootkit targets diplomatic agencies in Central Asia.
  • •Exploits the Baton Drop vulnerability to manipulate Secure Boot.
  • •Malicious driver signed with a revoked certificate from a Chinese organization.

In early 2026, a new UEFI bootkit named BlackX was discovered targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. This bootkit exploits the Baton Drop vulnerability to install custom Machine Owner Keys, allowing it to manipulate Secure Boot. The attack involves dropping an installer executable and an encrypted file containing the necessary components for installation. The malicious driver deployed by BlackX is signed with a revoked certificate from a Chinese organization. While the BlackLotus bootkit has been inactive since updates were released, BlackX appears to borrow techniques from it, suggesting a possible link between cybercriminals and APT actors. The current status of BlackX indicates it is actively being used in targeted attacks against specific organizations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-01-01
Discovery of BlackX bootkit
Researchers identified the BlackX bootkit being used in an APT campaign against Central Asian diplomatic agencies.
Securelist
2026-10-22
BlackX attack reported
The bootkit was confirmed to exploit the Baton Drop vulnerability, affecting systems with UEFI Secure Boot.
Securelist

More articles in this cluster (5)

Following this threat?

Track APT41 and BlackLotus in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

What systems are affected by BlackX?
BlackX targets systems with UEFI Secure Boot enabled, particularly those used by diplomatic agencies in Central Asia.
How is BlackX being delivered?
The bootkit is installed after attackers gain administrator privileges and drop an installer executable along with an encrypted payload.
What should organizations do to protect themselves?
Organizations should ensure their systems are updated and monitor for unusual activity, especially in sensitive environments.