The machines were fully patched. That is the uncomfortable finding at the centre of new research from Kaspersky's Global Research and Analysis Team (GReAT), which says a China-linked espionage group planted a firmware-level implant on computers at diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan in early 2026, using a Secure Boot flaw that Microsoft patched years ago.
The implant, which Kaspersky calls BlackX, is a UEFI bootkit: malware that loads from the computer's firmware before Windows starts, which lets it run beneath most security tools and survive a reinstall of the operating system. Researchers Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov describe it as closely modelled on BlackLotus, the bootkit that was sold on a hacking forum for $5,000 in 2022 and confirmed as real in 2023, then went quiet after Microsoft shipped fixes. Their original report attributes the campaign to APT41 with medium confidence.
A cybercrime bootkit in a spy's toolkit
Like BlackLotus, BlackX abuses the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and install custom Machine Owner Keys, which lets the attackers load their own EFI files at startup. Kaspersky says the exploit chain is "remarkably similar" to BlackLotus but not identical, and notes that the BlackLotus source code was never published. That leaves two possibilities, in the researchers' words: the attackers reverse-engineered BlackLotus, or bought its source from criminals. Either way, Kaspersky says it rarely sees APT groups borrow code from cybercrime actors.
The bootkit was not the way in. The attackers deployed it only after they had already compromised the victims' networks and obtained administrator rights, dropping an installer at C:\ProgramData\Intel\inst.exe alongside an RC4-encrypted container that held every component the installer needed.
What runs once the bootkit is in
BlackX injects a kernel driver signed with a certificate issued to a Chinese entity, Wenjiang District Mingyu Network Technology Service Studio, which has since been revoked. The driver disables callbacks used by security products, tampers with Event Tracing for Windows (ETW) providers so defenders lose visibility, and hides the bootkit's own files by handing back a handle to calc.exe whenever something tries to open them.
The driver then deploys one of two espionage payloads. One is a remote access trojan that loads further .NET modules and takes its orders through Google Drive, OneDrive and Yandex.Disk. The other, which Kaspersky named OxiDLLRunner, is an OLLVM-obfuscated DLL sideloaded through a legitimate executable that decrypts a Rust payload talking to a command server at www[.]archivetj[.]com.
The attribution rests on three threads. Kaspersky says the identifier "xdd" in BlackX matches a PDB path ESET reported in June 2026 in a FishMonger kernel implant, a group the research community links to APT41, and it assesses that BlackX is the unnamed UEFI component ESET's post alluded to. DLL sideloading with an encrypted payload file, and OLLVM obfuscation, are both common among Chinese-speaking actors.
The Baton Drop fix needs a manual switch
The reason patched machines were vulnerable, Kaspersky says, is that Microsoft's Baton Drop update does not finish the job on its own. Real protection requires revoking the "Windows Production PCA 2011" certificate that signed the vulnerable boot components, and that revocation only happens after an administrator sets a registry flag under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot and a scheduled task named Secure-Boot-Update runs. Microsoft designed it that way because automatic revocation could break dual-boot systems, and its planned automatic "Enforcement Phase" has not yet arrived. The certificate expired on October 19, 2026, but Kaspersky stresses that expiry does not stop vulnerable binaries from loading unless the certificate is blocklisted.
Organisations that installed the Baton Drop updates should check whether the revocation step was ever completed on their fleet, particularly on high-value Windows endpoints. Defenders can also hunt for the indicators Kaspersky published:
- C2 domain: www[.]archivetj[.]com
- Revoked driver-signing certificate serial: 0bcdf5e0da32d68900b8b7638459d072
- Installer path: C:\ProgramData\Intel\inst.exe with an extensionless companion file named PVMDIJGKAX2
The lesson extends well beyond Central Asia. BlackLotus was treated as a solved problem once patches shipped, yet a patient attacker read the fine print and found that "patched" and "protected" were not the same state. Earlier this year IntelFusions reported on old signed bootloaders that undermine Secure Boot, and on custom backdoors aimed at Central Asian ministries. BlackX sits where those two stories meet.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.