BlackX UEFI Bootkit Targets Diplomatic Entities in Central Asia, Bypasses Secure Boot

In early 2026, diplomatic entities across Central Asia were targeted by a newly identified UEFI bootkit designated BlackX. According to a technical report from Kaspersky, the malware was deployed in campaigns singling out government and diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The activity is suspected to be orchestrated by APT41, a China-linked state-sponsored hacking group.

BlackX operates at the firmware level, allowing it to persist across operating system reinstalls and bypass Secure Boot—a key security feature designed to prevent unauthorized code from loading during the boot process. Kaspersky's analysis indicates that the bootkit can bypass Secure Boot on Windows systems that have been patched but are missing specific revocations intended to block malicious firmware components. This means that even fully updated systems may remain vulnerable if the firmware revocation list has not been updated to include the BlackX component.

The report highlights that the exploitation relies on the absence of these revocations, rather than a failure to apply OS patches. Kaspersky has attributed the campaign to APT41 with moderate confidence, noting the group's known interest in diplomatic and geopolitical targets. As of the report publication, no specific vendor firmware patch has been released; mitigation focuses on ensuring Secure Boot revocation lists are current and monitoring for anomalous firmware behavior.