BlackX UEFI Bootkit Exploits Baton Drop in Central Asia APT Campaign
Summary
Kaspersky researchers detail BlackX, a BlackLotus-like UEFI bootkit used against diplomatic agencies in Central Asia. It exploits Baton Drop despite installed patches when certificate revocation is not activated; attribution to APT41 is medium confidence.
Key points
- Kaspersky identified BlackX in an early 2026 campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan.
- Attackers reportedly gained administrator privileges before deploying BlackX, which exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys and load EFI files despite Secure Boot.
- The researchers found the targeted machines were patched, but the Baton Drop mitigation requires manually activating certificate revocation; the automatic enforcement phase had not been implemented at publication.
- BlackX delivers a kernel driver that tampers with security-solution callbacks and ETW providers, and protects bootkit files by returning a handle to calc.exe instead.
- Two observed espionage payloads include a RAT using Google Drive, OneDrive, or Yandex.Disk for C2, and OxiDLLRunner, which launches a Rust payload communicating with www[.]archivetj[.]com.
- Kaspersky assesses APT41 attribution with medium confidence, citing similarities to activity discussed in an ESET report and payload characteristics associated with Chinese-speaking actors.
Article Details
- Attack Vectors
- After compromising victim networks and obtaining administrator privileges, attackers deployed BlackX from an installer and an RC4-encrypted extensionless package.
- BlackX exploits Baton Drop (CVE-2022-21894) to install custom Machine Owner Keys and load arbitrary EFI files, enabling manipulation of Secure Boot.
- A bootkit-delivered payload is loaded through a legitimate executable abused via DLL sideloading.
- A bootkit-delivered UEFI payload injects a malicious driver into the Windows kernel; the driver tampers with security callbacks and ETW providers.
- The OxiDLLRunner DLL decrypts v8_context_snapshot.bin and launches shellcode followed by a Rust payload that communicates with a C2 server.
- Defensive Notes
- Ensure the Baton Drop patch is fully activated: installing the update alone does not automatically revoke the vulnerable signing certificate; the source says manual activation requires a registry flag and a scheduled task named Secure-Boot-Update.
- Monitor Secure Boot revocation and enforcement status; the article reports that automatic enforcement had not yet been implemented at publication time.
- Deploy security solutions across organizational machines and monitor the alerts they raise.
- Kaspersky recommends its Exploit Prevention component as a measure against exploits when a patch is unapplied or no patch is available.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | www[.]archivetj[.]com | C2 server contacted by the Rust payload delivered through the bootkit. |
| MD5 | af8a983b9ada07eae1259bf2953abd40 | MD5 hash of jcef_helper.exe, the legitimate executable delivered by the bootkit and abused to load OxiDLLRunner. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationOxiDLLRunner is obfuscated with OLLVM, and the installer package contains an RC4-encrypted file.T1055 · Process InjectionThe UEFI payload injects a malicious driver into the Windows kernel.T1059.001 · PowerShellThe RAT processes .NET tasks by running TEST.Class1.RunCMD(argument_array).T1102 · Web ServiceThe RAT uses Google Drive, OneDrive, and Yandex.Disk for C2 communications and task and file exchange.T1105 · Ingress Tool TransferThe RAT can download files to infected machines, and the Rust payload receives DLL files from its C2 server.T1140 · Deobfuscate/Decode Files or InformationThe RAT decrypts an RC4-encrypted installer package, and OxiDLLRunner decrypts v8_context_snapshot.bin before execution.T1542.003 · BootkitBlackX installs a UEFI bootkit that runs before the operating system.T1547.006 · Kernel Modules and ExtensionsThe Baton Drop exploitation chain installs custom Machine Owner Keys to load arbitrary EFI files and manipulate Secure Boot.T1562.001 · Disable or Modify ToolsThe kernel driver disables security-related process, thread, and registry callbacks and tampers with ETW providers.T1574.002 · DLL Side-LoadingOxiDLLRunner is loaded through DLL sideloading by the delivered legitimate executable googleupdate.exe.
CVE
Threat Actors
Malware
Vendors
ESETHowever, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine.KasperskyBack in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum.MicrosoftAs this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it.
Products
Google DriveThis RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk.Microsoft OneDriveThis RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk.Microsoft WindowsThe UEFI payload delivered during the Baton Drop exploitation has a classic bootkit goal — to inject a malicious driver into the Windows kernel.Secure BootA cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000.Yandex DiskThis RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk.
Countries
TajikistanIn early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan.TurkmenistanIn early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan.UzbekistanIn early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan.