Kaspersky found BlackX on diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It exploits Baton Drop (CVE-2022-21894) like BlackLotus, installs custom Machine Owner Keys, injects a kernel driver that blinds security tools (callbacks, ETW) and drops cloud-C2 RATs. Victims were fully patched because Microsoft's PCA 2011 revocation is opt-in. Hunt for:

1. C:\ProgramData\Intel\inst.exe run with an RC4-encrypted file argument (seen: inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1).
2. Unexpected files on the EFI system partition and new MOK enrollments.
3. Kernel drivers signed by Wenjiang District Mingyu Network Technology Service Studio (cert serial 0bcdf5e0da32d68900b8b7638459d072, now revoked).
4. googleupdate.exe that is really jcef_helper.exe (MD5 AF8A983B9ADA07EAE1259BF2953ABD40) beside a v8_context_snapshot.bin; the OLLVM-obfuscated OxiDLLRunner sideloads there.
5. C2 to www[.]archivetj[.]com, and a .NET RAT polling Google Drive, OneDrive or Yandex.Disk for files with suffixes like 0X01 or SSSR.