Xitoyning APT41 xakerlari Tojikiston, O'zbekiston va Turkmanistondagi diplomatik tashkilotlarga qarshi UEFI bootkit — BlackX'ni joylashtirgan deb gumon qilinmoqda.
Tadqiqotchilar operatsiyani o'rta ishonch bilan APT41'ga bog'lashmoqda.
BlackX 2022-yil oktyabrida yer osti forumlarida 5000 dollarga reklama qilingan BlackLotus bootkitiga juda o'xshaydi.
ESET 2023-yil mart oyida uning imkoniyatlarini tasdiqlab, Baton Drop (CVE-2022-21894) zaifligidan foydalanishni namoyish etgan.
Microsoft bu zaiflikni 2022-yil yanvarda tuzatgan bo'lsa-da, hujumchilar hali bekor qilinmagan, qonuniy imzolangan eski yuklash komponentlarini kiritishlari mumkin edi.
Hujumchilar tarmoqlarni buzib, administrator huquqlarini qo'lga kiritgandan so'ng BlackX'ni joylashtirishadi. Uning o'rnatuvchisi inst.exe RC4 bilan shifrlangan, kengaytmasiz PVMDIJGKAX2 nomli konteyner bilan birga ishlaydi.
Kuzatilgan bajarilishda Q46F6MDLI3RX2KV1 shifrni ochish kaliti sifatida ishlatiladi. O'rnatish komponentlarini bajariladigan fayl tashqarisida saqlash, javob beruvchilar faqat o'rnatuvchini qo'lga kiritganida tiklash va tahlilni murakkablashtiradi.
O'rnatish zanjiri komponentlarni Windows va EFI bo'limlariga joylashtiradi, so'ngra Baton Drop zaifligidan foydalanib hujumchi nazoratidagi Machine Owner Keys (MOK) kalitlarini ro'yxatga oladi.
Bu kalitlar keyinchalik manipulyatsiya qilingan yuklash zanjiri orqali zararli EFI ilovalarini yuklash imkonini beradi.
Kaspersky kampaniyani 2026-yil boshida aniqlagan; u Windows Secure Boot himoya bo'shlig'idan foydalanadi, bu esa hatto to'liq yangilangan tizimlarni ham administratorlar yuklash komponentlarini bekor qilishni aniq faollashtirmagan bo'lsa, zaif qoldiradi.
APT41 bilan bog'liq Bootkit Hujumi
Kaspersky BlackLotus bilan sezilarli o'xshashliklarni, shuningdek, amalga oshirishdagi farqlarni kuzatgan, bu esa tasdiqlangan rivojlanish aloqasini o'rnatmasdan, teskari muhandislik yoki uning manba kodiga kirish imkoniyatini ko'rsatadi.
Keyinchalik BlackX zararli drayverni Windows yadrosiga in'ektsiya qiladi. BlackLotus drayveridan farqli o'laroq, bu komponent Wenjiang District Mingyu Network Technology Service Studio'ga tegishli sertifikat bilan imzolangan. Sertifikat beruvchi bu sertifikatni bekor qilgan.
Drayver xavfsizlik bilan bog'liq jarayon, oqim va registr qayta chaqiruvlarini o'chiradi hamda Windows Event Tracing provayderlariga aralashadi. Shuningdek, bootkit fayllarini ochish urinishlarini calc.exe tomon yo'naltirish orqali himoya qiladi.
Biroq Kaspersky sinov paytida mahsulotga xos buzish tartiblari uning xavfsizlik dasturiga aralasha olmaganini xabar qilgan.
Tadqiqotchilar ikkita foydalanuvchi rejimidagi yuklamani aniqlagan. Biri — Google Drive, OneDrive yoki Yandex.Disk orqali buyruq va nazorat aloqalari uchun foydalaniladigan masofaviy kirish troyani.
BlackLotus reklama (Manba: Kaspersky).
Fayl kengaytmalari ko'rsatmalar va natijalarni aniqlaydi, bu esa qo'shimcha .NET bajarilishini, fayl uzatishlarini va dastlabki tizim ma'lumotlari hisobotini qo'llab-quvvatlaydi.
Ikkinchisi — OxiDLLRunner, OLLVM obfuskatsiyasidan foydalanadi va qonuniy bajariladigan faylni googleupdate.exe nomi bilan qayta nomlash orqali DLL sideloading kirishiga ega bo'ladi.
U v8contextsnapshot.bin faylini shifrni ochib, shellcode va www[.]archivetj[.]com bilan aloqa qiladigan Rust yuklamasini ochib beradi. Yuklab olingan DLL plaginlari create_plugin eksport qiladi va alohida oqimlarda bajariladi.
Attributsiya qisman "xdd" identifikatoriga asoslanadi, bu ham ESET'ning 2026-yil iyun oyidagi FishMonger tadqiqotida hujjatlashtirilgan drayver ishlab chiqish yo'lida mavjud.
ESET aniqlanmagan bootkitning cheklangan belgilarini xabar qilgan, ehtimol CVE-2023-24932 zaifligidan foydalanadi. Kaspersky BlackX bu kuzatishlarni tushuntirishi mumkin deb baholaydi, ammo bu bog'liqlik hali ham taxminiy qoladi.
Asosiy zaiflik — shunchaki yangilanishlar yetishmasligi emas, balki to'liq bekor qilinmaslikdir. Microsoft'ning yumshatish chorasi Secure Boot ishonch ma'lumotlar bazasini yangilashni va Windows Production PCA 2011 sertifikatini taqiqlangan imzolar ma'lumotlar bazasi (DBX) orqali aniq bekor qilishni talab qiladi. Microsoft yo'riqnomasi bu yumshatishlar sukut bo'yicha yoqilmaganligini ta'kidlaydi.
Bu sertifikat 2026-yil 19-oktyabrda muddati tugagan bo'lsa-da, Kaspersky faqat muddati tugashi zaif binar fayllarni bloklamasligini aytadi.
Administratorlar bekor qilish holatini tekshirishi va Microsoft'ning bosqichma-bosqich joylashtirish yo'riqnomasiga, jumladan, tiklash vositalarini yangilash va yuklash mosligini sinovdan o'tkazishga amal qilishi kerak.
Ishonchli almashtirish komponentlarini avval tayyorlamasdan bekor qilishni qo'llash tizimlarning yuklanishiga to'sqinlik qilishi mumkin, shuning uchun nazorat ostida tarqatish va tekshirish muhimdir.
Suspected Chinese APT41 hackers have deployed BlackX, a UEFI bootkit, against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan.
Researchers attribute the operation to APT41 with medium confidence.
BlackX closely resembles BlackLotus, the bootkit advertised on underground forums for $5,000 in October 2022.
ESET confirmed its capabilities in March 2023, demonstrating exploitation of Baton Drop, tracked as CVE-2022-21894.
Although Microsoft patched that vulnerability in January 2022, attackers could still introduce older, legitimately signed boot components that had not been revoked.
Attackers deploy BlackX after compromising networks and obtaining administrator privileges. Its installer, inst.exe, operates alongside an RC4-encrypted, extensionless container named PVMDIJGKAX2.
The observed execution uses Q46F6MDLI3RX2KV1 as the decryption key. Keeping installation components outside the executable complicates recovery and analysis when responders obtain only the installer.
The installation chain places components on Windows and EFI partitions, then exploits Baton Drop to enroll attacker-controlled Machine Owner Keys.
These keys enable subsequent loading of malicious EFI applications through the manipulated boot chain.
Kaspersky discovered the campaign in early 2026; it exploits a Windows Secure Boot protection gap that leaves even fully patched systems exposed when administrators have not explicitly activated bootloader revocations.
APT41-Linked Bootkit Attack
Kaspersky observed substantial similarities to BlackLotus, alongside implementation differences, suggesting reverse engineering or access to its source code rather than establishing a confirmed development relationship.
BlackX subsequently injects a malicious driver into the Windows kernel. Unlike BlackLotus’s driver, this component was signed using a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio. The issuer has since revoked that certificate.
The driver turns off security-related process, thread, and registry callbacks and interferes with Event Tracing for Windows providers. It also protects bootkit files by redirecting attempts to open them toward calc.exe.
However, Kaspersky reported that product-specific tampering routines failed to interfere with its security software during testing.
Researchers identified two user-mode payloads. One is a remote-access trojan that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control communications.
BlackLotus advertisement (Source : Kaspersky).
File suffixes identify instructions and results, supporting additional .NET execution, file transfers, and initial system-information reporting.
The second, OxiDLLRunner, uses OLLVM obfuscation and DLL sideloading access through a legitimate executable renamed googleupdate.exe.
It decrypts v8contextsnapshot.bin to expose shellcode and a Rust payload communicating with www[.]archivetj[.]com. Downloaded DLL plugins export create_plugin and execute in separate threads.
Attribution partly rests on the identifier “xdd,” also present in a driver development path documented in ESET’s June 2026 FishMonger research.
ESET reported limited indications of an unspecified bootkit, possibly exploiting CVE-2023-24932. Kaspersky assesses that BlackX could explain those observations, but the connection remains inferential.
The central weakness is incomplete revocation, not simply missing patches. Microsoft’s mitigation requires updating Secure Boot trust databases and explicitly revoking Windows Production PCA 2011 through the forbidden-signature database, or DBX. Microsoft’s guidance states these mitigations are not enabled by default.
Although that certificate expired on October 19, 2026, Kaspersky says expiration alone does not block vulnerable binaries.
Administrators should validate revocation status and follow Microsoft’s staged deployment guidance, including updating recovery media and testing boot compatibility.
Applying revocations without first preparing trusted replacement components can prevent systems from booting, making controlled rollout and verification essential.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.