Kaspersky's Global Research and Analysis Team (GReAT) said on 22 October 2026 that in early 2026 it identified a complex APT attack on diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan that used a UEFI bootkit it named BlackX, which it found to be similar to the BlackLotus bootkit.

Kaspersky says the attackers deployed BlackX after compromising victim networks and obtaining administrator privileges, dropping an installer (inst.exe) and an RC4-encrypted file (PVMDIJGKAX2) that write files to the system and UEFI partitions to exploit the Baton Drop vulnerability (CVE-2022-21894) and install custom Machine Owner Keys (MOK), allowing arbitrary EFI files to load.

Because BlackLotus source code has never been published, Kaspersky says the attackers either reverse-engineered BlackLotus or bought its source code. The UEFI payload injects a kernel driver, signed with a since-revoked certificate of 'Wenjiang District Mingyu Network Technology Service Studio', that disables security-product callbacks, tampers with ETW providers and protects the bootkit files; it drops user-mode espionage payloads: a RAT that uses Google Drive, OneDrive or Yandex.Disk for command and control, and an OLLVM-obfuscated DLL Kaspersky calls OxiDLLRunner, side-loaded by a legitimate googleupdate.exe, that runs a Rust payload talking to www[.]archivetj[.]com.

Kaspersky attributes the attack to APT41 with medium confidence, citing the 'xdd' identifier shared with a FishMonger kernel implant described by ESET in June 2026, DLL side-loading and OLLVM obfuscation.

Kaspersky says the targeted machines were fully patched: the Baton Drop fix revokes the 'Windows Production PCA 2011' certificate only when an administrator triggers it manually, Microsoft's planned automatic 'Enforcement Phase' has not been implemented, and the certificate's expiry on 19 October 2026 does not stop vulnerable binaries loading unless it is blocklisted.

Microsoft's own guidance says the mitigations for the related BlackLotus Secure Boot bypass (CVE-2023-24932) are included in Windows security updates since 9 July 2024 but are not enabled by default, and that this malware requires physical or administrative access to the device. Primary: Kaspersky Securelist.

Updated 23 Oct 2026: The Hacker News reported the research. (source: The Hacker News)