APT41 uses BlackX bootkit to bypass Secure Boot in Central Asia

1. Executive summary

Kaspersky GReAT reports a UEFI bootkit it names BlackX, closely modelled on BlackLotus, used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The bootkit exploits Baton Drop (CVE-2022-21894, CVSS 4.4 MEDIUM, CWE-863 Incorrect Authorization, not in CISA KEV, EPSS 7%) to install custom Machine Owner Keys and load arbitrary EFI files past Secure Boot. Kaspersky attributes the campaign to APT41 (MITRE G0096) with medium confidence; the attribution rests on a single vendor report and is unconfirmed. The exposure for EMEA financial services is not the CVSS rating but the patch-deployment gap: fully patched Windows hosts remain exploitable because the Baton Drop fix requires a manual certificate revocation step that most administrators do not perform.

2. Regulatory framing

3. Technical analysis & attack chain

Kaspersky observed the following sequence. Each step is from the Kaspersky report; the initial access vector that precedes step 1 is not described in the source.

1. The actor compromises the victim network and obtains administrator privileges on the target machine.
2. The actor drops two files: inst.exe, an installer executable, and PVMDIJGKAX2, an RC4-encrypted extensionless file holding the files and strings needed for installation.
3. The installer runs as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1, where the final argument is the RC4 key used to decrypt PVMDIJGKAX2. inst.exe itself contains no malicious strings or embedded blobs, which frustrates responders trying to recover bootkit components from the installer alone.
4. The installer drops files to both the system partition and the UEFI partition and runs the Baton Drop exploit. The exploit installs custom Machine Owner Keys (MOK), allowing arbitrary EFI files to load and Secure Boot to be manipulated. Kaspersky notes the exploit implementation is very similar to BlackLotus but not identical.
5. The UEFI payload injects a malicious Windows kernel driver. The driver is signed with a certificate belonging to 温江区明宇网络技术服务工作室 (Wenjiang District Mingyu Network Technology Service Studio), serial number 0bcdf5e0da32d68900b8b7638459d072, which the issuer has since revoked.
6. The driver tampers with security solutions: it disables process, thread and registry callbacks related to security products and tampers with ETW providers so security tools cannot read their output. Some tampering routines are coded to run only when Kaspersky or Avast products are present, though Kaspersky found in dynamic analysis that these routines fail to interfere with its own products.
7. The driver protects the bootkit's files by intercepting kernel requests to open them and returning a handle to calc.exe in place of the malicious file handle.
8. The driver deploys user-mode payloads for espionage. Kaspersky observed two.

The first payload is a RAT that loads further-stage .NET payloads and uses cloud storage for command and control, with observed versions using Google Drive, OneDrive and Yandex.Disk. It iterates files on the storage service and acts on the file suffix: 0X01 is a .NET file whose TEST.Class1.RunCMD(argument_array) method is parsed and run; 0X02 is the returned result; 0X03 is an upload task and 0X04 the uploaded file; 0X05 is a download task and 0X06 the download status; SSSR carries initial system information.

The second payload, OxiDLLRunner, is a malicious DLL obfuscated with OLLVM. It is loaded by a legitimate file named googleupdate.exe (original filename jcef_helper.exe, MD5 AF8A983B9ADA07EAE1259BF2953ABD40), also delivered by the bootkit. The DLL decrypts v8_context_snapshot.bin in the same folder and jumps to the start of the decrypted content, which is shellcode followed by a Rust payload that communicates with the C2 server www[.]archivetj[.]com. That payload receives DLLs exporting a function named create_plugin and runs them in separate threads.

The patch gap is the part that matters most. Baton Drop was disclosed in 2023 and patched, and Kaspersky initially assumed the victims were unpatched. Its investigation found the targeted machines were fully patched. The Microsoft fix revokes the "Windows Production PCA 2011" certificate used to sign vulnerable UEFI components, but the revocation does not happen automatically on patch installation; an administrator must trigger it manually. Microsoft made it manual because automatic application could break dual-boot systems that rely on that certificate. Microsoft's deployment plan describes an "Enforcement Phase" that would revoke the certificate automatically, and Kaspersky states that phase had not been implemented at the time of publication. The certificate expired on 19 October 2026, but expiry alone does not stop the vulnerable binaries loading unless the certificate is blocklisted.

Attribution to APT41 is Kaspersky's, at medium confidence, and the report does not set out the specific facts behind it in the excerpt available here. Treat the attribution as unconfirmed. The link between BlackX and BlackLotus is also inferential: the BlackLotus source has never been published, so Kaspersky suggests the BlackX authors either reverse-engineered the bootkit or bought its source. The whole technical account is single-sourced to Kaspersky GReAT; no second vendor corroboration is available in the material reviewed.

4. Mitigation & containment

P1 (within 24 hours)

• Verify Baton Drop remediation on every Windows estate, not just patch level. Confirm the "Windows Production PCA 2011" certificate is revoked and blocklisted per Microsoft's manual instructions, and record which hosts have completed the manual step. A host reporting the update installed but without the revocation is still exposed.
• Hunt for the installer artefacts: C:\ProgramData\Intel\inst.exe, the extensionless file PVMDIJGKAX2, and process command lines matching inst.exe with an RC4 key argument. Isolate any host where they appear and preserve the UEFI partition before remediation.
• Block or alert on the C2 domain www[.]archivetj[.]com at egress and proxy. Because the RAT also uses Google Drive, OneDrive and Yandex.Disk, review cloud-storage egress from servers and administrative workstations, which rarely need it.
• Check for the revoked signing certificate serial 0bcdf5e0da32d68900b8b7638459d072 on loaded kernel drivers and alert on any driver signed by it.

P2 (within 72 hours)

• Search for googleupdate.exe whose original filename is jcef_helper.exe and for v8_context_snapshot.bin outside legitimate Chromium or Electron installs. The pairing of a renamed helper with that snapshot file is the OxiDLLRunner loader pattern.
• Enable boot integrity monitoring where the EDR supports it and add a boot-chain check to incident triage, since the driver hides its own files from kernel open requests by returning a calc.exe handle.
• Confirm EDR coverage and alerting on all endpoints. The driver disables process, thread and registry callbacks and tampers with ETW, so a host that has gone quiet on telemetry is a signal, not an all-clear.

P3 (within 7 days)

• Add the manual certificate-revocation step to the standard Windows patch runbook so it is performed with every relevant update rather than left to individual administrators.
• Test dual-boot and recovery images against the revocation before rolling it estate-wide, since that compatibility risk is why Microsoft made the step manual.
• Review whether any EMEA-facing diplomatic, government-adjacent or Central Asia liaison endpoints sit in the same administrative trust boundary as the targeted agencies.

5. Indicators of compromise

The MD5 is reproduced as given by Kaspersky; it is a 32-character value and is labelled md5 by length. All indicators are single-sourced to Kaspersky GReAT; verify before enforcement.

md5  AF8A983B9ADA07EAE1259BF2953ABD40
domain  www[.]archivetj[.]com
filepath  C:\ProgramData\Intel\inst.exe
filename  PVMDIJGKAX2
filename  v8_context_snapshot.bin
filename  jcef_helper.exe
certificate_serial  0bcdf5e0da32d68900b8b7638459d072

Behavioural indicators

6. Detection

rule APT41_BlackX_Bootkit_Installer
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-22"
        reference = "https://securelist.com/uefi-bootkit-blackx/121539/"
        description = "Detects BlackX bootkit installer artefacts and OxiDLLRunner loader components"
    strings:
        $inst = "inst.exe" ascii wide
        $pkg = "PVMDIJGKAX2" ascii wide
        $key = "Q46F6MDLI3RX2KV1" ascii wide
        $snap = "v8_context_snapshot.bin" ascii wide
        $helper = "jcef_helper.exe" ascii wide
        $plugin = "create_plugin" ascii wide
        $cmd = "TEST.Class1.RunCMD" ascii wide
        $s1 = "0X01" ascii wide
        $s2 = "0X02" ascii wide
        $s3 = "0X03" ascii wide
        $s4 = "0X04" ascii wide
        $s5 = "0X05" ascii wide
        $s6 = "0X06" ascii wide
        $sssr = "SSSR" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (
            (2 of ($inst, $pkg, $key)) or
            (2 of ($snap, $helper, $plugin)) or
            ($cmd and 2 of ($s1, $s2, $s3, $s4, $s5, $s6, $sssr))
        )
}

title: BlackX bootkit installer execution
id: 7f3c2a91-4b6e-4d2a-9c1e-0a5b8d3e6f21
status: experimental
description: Detects execution of the BlackX bootkit installer with its RC4 key argument
author: Adverse Trace
date: 2026-10-22
references:

    - https://securelist.com/uefi-bootkit-blackx/121539/
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\inst.exe'
    selection_path:
        Image|startswith: 'C:\ProgramData\Intel\'
    selection_args:
        CommandLine|contains:

            - 'PVMDIJGKAX2'
            - 'Q46F6MDLI3RX2KV1'
    condition: selection_img and (selection_path or selection_args)
falsepositives:

    - Legitimate software named inst.exe in ProgramData\Intel (unlikely; verify path and arguments)
level: critical

title: Renamed jcef_helper running as googleupdate loading OxiDLLRunner
id: 2d8e5b47-9a1c-4f63-b0d2-6c4a7e9f1b83
status: experimental
description: Detects googleupdate.exe whose original filename is jcef_helper.exe, the OxiDLLRunner loader
author: Adverse Trace
date: 2026-10-22
references:

    - https://securelist.com/uefi-bootkit-blackx/121539/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\googleupdate.exe'
        OriginalFileName: 'jcef_helper.exe'
    condition: selection
falsepositives:

    - None expected; legitimate Google Update does not carry the jcef_helper original filename
level: high

CVE assessment

1 referenced CVE

Threat actor context

APT41 · G0096 · aka Wicked Panda, Brass Typhoon, BARIUM

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries. …

7. Sources

• Kaspersky GReAT, "How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia", https://securelist.com/uefi-bootkit-blackx/121539/, 2026-10-22.
• Kaspersky GReAT, "New BlackX UEFI bootkit exploiting Baton Drop", https://securelist.com/uefi-bootkit-blackx/121539/, 2026-10-22.

8. Adverse Trace position

Adverse Trace assesses CVE-2022-21894 at CVSS 4.4 MEDIUM, not in CISA KEV, EPSS 7%, and does not raise that rating: the flaw is old, patched and not under mass exploitation. The operational risk sits elsewhere. The Baton Drop fix only takes effect after a manual certificate revocation that most administrators will not perform, so a fully patched estate can still be compromised, and the BlackX driver actively blinds EDR callbacks and ETW once it loads. Attribution to APT41 is Kaspersky's at medium confidence and is single-sourced; we treat it as unconfirmed and will not use it to drive blocking decisions. The targeting is diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, with no EMEA financial services victim reported. We will monitor for further vendor corroboration of BlackX and for any change to Microsoft's Enforcement Phase, and we will reissue this advisory if either appears. Clients should confirm this week that the Windows Production PCA 2011 revocation has actually been applied across their estate, not merely that the update was installed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.