---
title: Hunt: BlackX, a BlackLotus-style UEFI bootkit tied to APT41, hit fully patched Central Asian diplomatic machines via Baton Drop | ctxsec
url: https://ctxsec.com/items/hunt-apt41-blackx-uefi-bootkit
description: ""
status: "confirmed research (Kaspersky Securelist, Oct 22); APT41 attribution is medium confidence"
published: 2026-10-22
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-apt41-blackx-uefi-bootkit.md)

confirmed research (Kaspersky Securelist, Oct 22); APT41 attribution is medium confidence

2026-10-22

### Hunt: BlackX, a BlackLotus-style UEFI bootkit tied to APT41, hit fully patched Central Asian diplomatic machines via Baton Drop

Kaspersky found **BlackX** on diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It exploits Baton Drop (CVE-2022-21894) like BlackLotus, installs custom Machine Owner Keys, injects a kernel driver that blinds security tools (callbacks, ETW) and drops cloud-C2 RATs. Victims were fully patched because Microsoft's PCA 2011 revocation is opt-in. Hunt for:

1. `C:\ProgramData\Intel\inst.exe` run with an RC4-encrypted file argument (seen: `inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1`).
2. Unexpected files on the EFI system partition and new MOK enrollments.
3. Kernel drivers signed by _Wenjiang District Mingyu Network Technology Service Studio_ (cert serial `0bcdf5e0da32d68900b8b7638459d072`, now revoked).
4. `googleupdate.exe` that is really `jcef_helper.exe` (MD5 `AF8A983B9ADA07EAE1259BF2953ABD40`) beside a `v8_context_snapshot.bin`; the OLLVM-obfuscated OxiDLLRunner sideloads there.
5. C2 to `www[.]archivetj[.]com`, and a .NET RAT polling Google Drive, OneDrive or Yandex.Disk for files with suffixes like 0X01 or SSSR.

Sources: [Kaspersky Securelist: BlackX UEFI bootkit](https://securelist.com/uefi-bootkit-blackx/121539/)