How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky researchers have uncovered a new UEFI bootkit, named BlackX, that closely mirrors the notorious BlackLotus malware and was used in targeted attacks against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan in early 2026. The attackers, attributed with medium confidence to the APT41 group, deployed BlackX after gaining administrator access, exploiting the Baton Drop flaw (CVE-2022-21894) to install rogue Machine Owner Keys and subvert Secure Boot on Windows machines. Notably, the compromised systems had already received Microsoft's official patch, but the fix requires administrators to manually trigger certificate revocation—a step most organizations overlook—leaving them exposed despite being "patched." The bootkit loads a kernel driver that blinds security tools and delivers espionage payloads, including a cloud-based RAT and a Rust-based implant communicating with a remote C2 server, underscoring how incomplete patch activation can leave even updated networks vulnerable.