Threat intel
BlackX UEFI Bootkit Targets Central Asian Diplomats, Bypasses Secure Boot on Patched Windows Systems
A new UEFI bootkit called BlackX targeted diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan in early 2026, in a campaign Kaspersky suspects was orchestrated by the China-linked group APT41. The bootkit can bypass Secure Boot on fully patched Windows systems that are missing revocations.
A newly discovered UEFI bootkit known as BlackX has been deployed in attacks against diplomatic organizations in Central Asia, according to a technical report from Kaspersky, as reported by The Hacker News.
The campaign, which took place in early 2026, singled out diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky said it suspects the activity is orchestrated by APT41, a state-sponsored hacking group linked to China.
UEFI bootkits rank among the most dangerous classes of malware because they operate at the firmware level, loading before the operating system starts. That position gives them deep control over an infected machine and makes them extremely difficult to detect or remove with conventional security tools.
According to the report, BlackX is notable for its ability to bypass Secure Boot, the mechanism designed to ensure that only trusted software runs during the Windows boot process. The bootkit achieves this even on systems that are otherwise fully patched, as long as those machines are missing the relevant revocations. The finding highlights a practical gap in endpoint defenses: applying operating system patches alone may not be enough to keep firmware-level protections effective if revocations have not been applied.
The targeting of diplomatic organizations across three Central Asian states points to an espionage-motivated operation rather than financially driven crime. Kaspersky's attribution to APT41 is described as a suspicion, but the report places BlackX within a broader pattern of advanced persistent threat activity directed at government and diplomatic targets in the region.
Source: The Hacker News
