Markaziy Osiyodagi diplomatik tashkilotlar BlackX deb nomlangan yangi, murakkab Unified Extensible Firmware Interface (UEFI) bootkit bilan nishonga olingan.
Kaspersky bu hafta e'lon qilgan texnik hisobotida aytilishicha, 2026-yil boshida Tojikiston, O'zbekiston va Turkmanistondagi diplomatik tashkilotlarni alohida nishonga olgan bu faoliyat APT41, Kaspersky deb nomlanuvchi Xitoy bilan bog'liq davlat homiyligidagi xakerlik guruhi tomonidan tashkil etilgan deb gumon qilinmoqda.
Zararli dasturiy ta'minotni joylashtirishning asosiy maqsadi Microsoft Windows ishga tushirish himoyalarini, shuningdek, uchinchi tomon xavfsizlik yechimlarini zaiflashtirish va buzilgan qurilmalarda uzoq muddatli, yashirin kirishni saqlab qolishdir.
Muhimi shundaki, BlackX 2022-yil oxirida kiberjinoyatchilik forumlarida reklama qilinib, 2023-yil mart oyida ESET tomonidan rasmiy tasdiqlangan mashhur BlackLotus bootkitining yangilangan versiyasi deb baholanmoqda.
BlackLotus hozirda tuzatilgan Secure Boot aylanib o'tish zaifligidan (CVE-2022-21894, CVSS balli: 4.4), shuningdek Baton Drop deb ham ataladigan zaiflikdan foydalanib, operatsion tizim ishga tushishidan oldin zararli kodni yuklash uchun mo'ljallangan. Biroq, muvaffaqiyatli foydalanish hujumchining maqsadli qurilmada administrator huquqlariga yoki jismoniy kirish huquqiga ega bo'lishini talab qiladi.
"Ushbu bootkitdan tahdid aktorining foydalanishi, asosan, doimiy kirish va himoyadan qochish mexanizmi ekanligini ta'kidlash muhimdir," deb ta'kidlagan Microsoft o'sha paytda. "Bu birinchi bosqich yuklamasi yoki dastlabki kirish vektori emas va faqat tahdid aktori allaqachon imtiyozli kirish yoki jismoniy kirish huquqiga ega bo'lgan qurilmaga joylashtirilishi mumkin."
Shunga qaramay, tahdidni to'liq bartaraf etish eng so'nggi yangilanishni o'rnatishdan tashqari qo'shimcha choralarni talab qiladi, jumladan, Microsoft Secure Boot revokatsiya yumshatish choralarini qo'llash uchun qo'lda qadamlar bajarish, masalan, "Windows Production PCA 2011" sertifikatini Secure Boot UEFI Forbidden List (DBX) ro'yxatiga qo'shish.
Rossiya kiberxavfsizlik kompaniyasi hujumchilarning tashkilotlar ushbu qo'lda qadamlarni bajarmaganligidan foydalanayotganini aniqlagan, bu esa ularga "tuzatma" o'rnatilgan tizimlarda ham Baton Drop zaifligidan foydalanishda davom etish imkonini beradi.
"2026-yil 19-oktabrda ushbu sertifikat muddati tugadi, ammo bu zaif binar fayllarning yuklanishiga to'sqinlik qilmaydi, agar sertifikat bloklanmagan bo'lsa," deb aytishgan tadqiqotchilar Georgy Kucherin, Vladimir Nestor va Vasiliy Berdnikov.
"Ehtimol, ushbu kampaniya ortidagi tahdid aktori kam sonli tashkilotlar Baton Drop tuzatmasini qo'lda faollashtirish muhimligini anglaganini hisobga olgan. Shuning uchun, ular BlackLotus qanday ishlashini tushunish va ushbu bootkitning nusxasini yaratish uchun vaqt sarflashga qaror qilgan deb o'ylaymiz."
Hujumchilar qurbon tarmoqlariga aniqlanmagan usul orqali kirib, administrator huquqlarini qo'lga kiritgandan so'ng BlackX ni joylashtirganlari kuzatilgan. Bootkitni o'rnatish uchun tahdid aktori quyidagi fayllarni tushiradi:
- inst.exe, o'rnatuvchi bajariladigan fayl
- PVMDIJGKAX2, o'rnatish uchun zarur fayl va satrlarni o'z ichiga olgan shifrlangan kengaytmasiz fayl
So'ngra o'rnatuvchi buyruq satri orqali "C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1" sifatida ishga tushiriladi, bu yerda "Q46F6MDLI3RX2KV1" shifrlashni ochish uchun ishlatiladigan RC4 kalitidir.
Binariy fayl keyin tizim va UEFI bo'limlariga qo'shimcha fayllarni tushiradi va CVE-2022-21894 zaifligidan BlackLotus da ishlatilgan usulga "ajoyib darajada o'xshash" tarzda foydalanadi. Yakuniy maqsad o'zgarmaydi: zararlangan xostlarda ixtiyoriy EFI fayllarini yuklash va Secure Boot bilan aralashish uchun Machine Owner Keys (MOK) ni o'rnatish.
Bu yerda e'tiborga loyiq jihat shundaki, BlackLotus ning to'liq manba kodi hech qachon ommaviy ravishda mavjud bo'lmagan, bu esa BlackX ortidagi tahdid aktorlari yoki asl bootkitni teskari muhandislik qilgan, yoki uning manba kodini boshqa tomondan sotib olganligini ko'rsatadi.
"Har qanday holatda ham, bu qiziqarli kuzatuv, chunki biz kamdan-kam hollarda APT aktorlarining kiberjinoyatchilik aktorlaridan g'oyalar yoki kodni o'zlashtirganini ko'ramiz," deb aytgan Kaspersky.
Zaiflikdan foydalanishdan so'ng yetkaziladigan UEFI yuklamasi Windows yadrosiga zararli drayverni in'ektsiya qilish uchun mo'ljallangan. Drayver Wenjiang District Mingyu Network Technology Service Studio deb nomlangan kompaniyaga tegishli sertifikat bilan imzolangan. Sertifikat chiqaruvchi tomonidan bekor qilingan.
BYOVD (o'z zaif drayveringizni olib keling) hujumi holatida bo'lgani kabi, drayver mashinada o'rnatilgan endpoint xavfsizlik dasturiy ta'minotining ishlashiga aralashishga urinadi. Qiziqarli burilish shundaki, ba'zi ruxsatsiz o'zgartirishlar faqat Kaspersky yoki Avast bilan bog'liq xavfsizlik dasturlari mavjud bo'lganda ishlashga ruxsat etiladi. Biroq, Kaspersky tahlili bu tartiblarni samarasiz deb topgan.
Xavfsizlik yechimlarini samarasiz qilishga urinish bilan cheklanmay, drayver shuningdek, kiberjosuslik uchun foydalanuvchi rejimidagi yuklamani ham tushiradi. Ikki shunday yuklama kuzatilgan:
- Qo'shimcha .NET yuklamalarini yetkazib bera oladigan, shuningdek, Google Drive, OneDrive va Yandex.Disk ni buyruq va nazorat (C2) uchun ishlatib, oddiy korporativ ish oqimlari bilan aralashadigan masofaviy kirish troyani. U shuningdek, tizim ma'lumotlarini yig'ish va qiziqish uyg'otadigan fayllarni yuklash qobiliyatiga ega.
- OxiDLLRunner deb nomlangan zararli DLL, bu qonuniy "googleupdate.exe" binariy tomonidan yonma-yon yuklanadi, bu ham bootkit tomonidan yetkaziladi. DLL Rust yuklamasini shifrlaydi va ishga tushiradi, bu yuklama "archivetj[.]com" bilan aloqa qiladi va ko'proq DLL plaginlarini qabul qilish va bajarish uchun ishlatiladi.
BlackX ning APT41 bilan aloqalari ESET ning 2026-yil iyun oyidagi hisobotidan kelib chiqadi, bu hisobot FishMonger ning 2023-2024-yillar oralig'ida Gonduras, Tayvan, Tailand va Pokiston hukumat tashkilotlariga qaratilgan hujumlarda SprySOCKS deb nomlangan Windows orqa eshik dasturidan foydalanishini hujjatlashtirgan. FishMonger, shuningdek Aquatic Panda va Earth Lusca deb ham kuzatiladi, APT41 soyasi ostida faoliyat yuritadi deb baholanadi.
Slovakiya kiberxavfsizlik kompaniyasi orqa eshikning ba'zi versiyalari CVE-2023-24932 zaifligidan foydalanadigan UEFI bootkit komponentiga ega bo'lishi mumkinligi haqida "cheklangan ko'rsatkichlar" topganini aytgan, bu Microsoft CVE-2022-21894 ni tuzatish uchun kiritgan yumshatish choralarini aylanib o'tishdir. Bu hujumchi imtiyozli huquqlarga ega bo'lib, operatsion tizimni Windows Boot Manager ning eski, qonuniy Microsoft imzolangan versiyasi bilan yuklashga majbur qilib, CVE-2022-21894 ni qayta kiritadigan pasaytirish hujumini ifodalaydi.
Qiziqarli o'xshashlik BlackX va FishMonger tomonidan ishlatilgan yadro implantida "xdd" satrining mavjudligidir, bu esa ushbu hujumlarda ishlatilgan UEFI bootkit aynan BlackX ekanligi ehtimolini oshiradi. Xitoy bilan bog'liq xakerlarga ishora qiladigan ikkinchi dalil DLL yonma-yon yuklash usulidan foydalanishdir — bu Xitoy kelib chiqishli tahdid aktorlari orasida juda keng tarqalgan naqshdir.
"Tijorat jinoyatchilik vositasini moslashtirish orqali, guruh Windows yuklash jarayonlarini himoya qilishga mo'ljallangan tartiblarni aylanib o'tishi mumkin," deb aytgan Kucherin. "Bu gibrid yondashuv murakkab dushmanlarga yuqori qiymatli tarmoqlarda doimiy, ko'rinmas nazoratni o'rnatish uchun g'ildirakni qayta ixtiro qilish shart emasligini isbotlaydi."
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX.
The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report published this week.
The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.
Notably, BlackX is assessed to be an updated version of BlackLotus, a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023.
BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts. However, successful exploitation hinges on an attacker having administrator privileges or physical access to a target host.
"It is critical to note that a threat actor's use of this bootkit is primarily a persistence and defense evasion mechanism," Microsoft noted at the time. "It is not a first-stage payload or an initial access vector and can only be deployed to a device to which a threat actor has already gained either privileged access or physical access."
That said, completely addressing the threat requires additional actions beyond installing the latest update, including running manual steps to apply Microsoft's Secure Boot revocation mitigations, such as adding the "Windows Production PCA 2011" certificate to the Secure Boot UEFI Forbidden List (DBX).
The Russian cybersecurity company has found that attackers are capitalizing on the fact that organizations have not carried out these manual steps, allowing them to continue using the Baton Drop vulnerability even on systems where the "patch" has been applied.
"On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted," researchers Georgy Kucherin, Vladimir Nestor, and Vasily Berdnikov said.
"It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."
Attackers have been observed deploying BlackX after breaching victim networks through an unspecified method and gaining administrator privileges. To install the bootkit, the threat actor drops the following files -
- inst.exe, an installer executable
- PVMDIJGKAX2, an encrypted extensionless file containing files and strings required for the installation
The installer is then launched via the command line as "C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1," where "Q46F6MDLI3RX2KV1" is the RC4 key used for decryption.
The binary then drops additional files to both system and UEFI partitions to exploit CVE-2022-21894 in a manner that's "remarkably similar" to the one used in BlackLotus. The end goal remains the same: install Machine Owner Keys (MOK) to load arbitrary EFI files on the infected hosts and interfere with Secure Boot.
What's noteworthy here is that the complete source code of BlackLotus has never been made publicly available, indicating that the threat actors behind BlackX either reverse-engineered the original bootkit or purchased its source code from another party.
"Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors," Kaspersky said.
The UEFI payload delivered following the exploitation of the vulnerability is engineered to inject a malicious driver into the Windows kernel. The driver has been signed with a certificate belonging to a company named Wenjiang District Mingyu Network Technology Service Studio. The certificate has since been revoked by the issuer.
Like in the case of the bring your own vulnerable driver (BYOVD) attack, the driver attempts to tamper with the functioning of endpoint security software installed on the machine. In an interesting twist, some of the unauthorized modifications are allowed to run only if security programs associated with Kaspersky or Avast are present. However, Kaspersky's analysis has found these routines to be ineffective.
Not just content with trying to render security solutions ineffective, the driver also drops a user-mode payload for cyber espionage. Two such payloads have been observed -
- A remote access trojan that can deliver additional .NET payloads, while using Google Drive, OneDrive, and Yandex.Disk for command-and-control (C2) to blend in with regular enterprise workflows. It's also equipped to harvest system information and upload files of interest.
- A malicious DLL dubbed OxiDLLRunner that's sideloaded by the legitimate "googleupdate.exe" binary, which is also delivered by the bootkit. The DLL decrypts and launches a Rust payload that communicates with "archivetj[.]com" to receive and execute more DLL plugins.
BlackX's connections to APT41 stem from an ESET report in June 2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca, is assessed to be operating under the APT41 umbrella.
The Slovakian cybersecurity company said it had found "limited indications" that some versions of the backdoor may feature a UEFI bootkit component likely exploiting CVE‑2023‑24932, a bypass for the mitigations introduced by Microsoft to fix CVE-2022-21894. It represents a downgrade attack in which a privileged attacker can force the operating system to boot using an older, legitimately Microsoft-signed version of the Windows Boot Manager to reintroduce CVE-2022-21894.
An interesting overlap is the presence of the "xdd" string in BlackX and the kernel implant used by FishMonger, raising the possibility that the UEFI bootkit used in those attacks is none other than BlackX. The second clue that points to China-aligned hackers is the use of DLL sideloading to deploy the payloads – a pattern that's extremely common among threat actors of Chinese origin.
"By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes," Kucherin said. "This hybrid approach proves that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.