BlackX UEFI bootkit targets Central Asian diplomatic entities to bypass Secure Boot

Diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan were targeted in early 2026 by a new Unified Extensible Firmware Interface bootkit named BlackX. The Hacker News, CyberSecurityNews, Cyber Press, Securelist, and GBHackers News all report that the malware allows hackers to bypass Windows Secure Boot on patched systems. The Hacker News and GBHackers News attribute the activity to a group linked to China, with GBHackers News specifically naming suspected Chinese APT41 hackers. [1][2][3][4][5]

According to Securelist, the BlackX bootkit achieves its persistence by exploiting a vulnerability known as Baton Drop. The Hacker News, CyberSecurityNews, and Cyber Press report that the bootkit successfully circumvents Microsoft Secure Boot controls even on fully updated systems, provided that outdated, vulnerable bootloaders have not been added to the revocation list. [1][2][3][4]

When a computer is powered on, the UEFI implementation initializes the hardware before the operating system or any other software loads. Common implementations include AMI Aptio, Phoenix SecureCore, TianoCore EDK II, and InsydeH2O. Bootkits that infect the firmware execute before traditional operating system protections can load. [6]