A sophisticated UEFI bootkit called BlackX has been identified in espionage operations targeting diplomatic agencies across Central Asia, including Tajikistan, Uzbekistan, and Turkmenistan. The malware exploits the Baton Drop vulnerability to bypass Secure Boot protections and load a malicious driver designed to interfere with antivirus software from Kaspersky and Avast. Kaspersky researchers attribute the campaign with medium confidence to APT41, a Chinese state-sponsored threat group. The BlackX bootkit shares similarities with BlackLotus, another bootkit that has circulated since 2022, suggesting the attackers either reverse-engineered BlackLotus or obtained its source code through other means.
The BlackX driver disables security processes and tampers with monitoring systems while protecting the bootkit’s files from user access. It deploys espionage payloads including a remote access tool that uses cloud storage services for command-and-control and a second-stage loader that retrieves additional plugins. Kaspersky notes that all victims ran fully patched Windows systems, but remained vulnerable because administrators did not manually activate additional Secure Boot revocations required to fully address the Baton Drop flaw. The researchers warn that the certificate revocation does not occur automatically during patching, creating a gap that attackers exploited.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
