How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

The return of the infamous bootkit

Payload launched by the bootkit

User-mode second-stage payloads

Why did the target organizations get infected?

Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.

BlackLotus advertisement

However, about half a year later, in March 2023, ESET confirmed that the BlackLotus advertisement was genuine. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it.

Since the release of these updates, the BlackLotus bootkit has gone quiet — no publicly known attacks have used it. Yet in early 2026, we discovered a malware sample similar to BlackLotus that was used in an APT campaign in Central Asia. In this report, we share our findings, including new payloads and possible attribution of this campaign.

In early 2026 we identified a complex APT attack targeting diplomatic agencies in Central Asian countries — namely Tajikistan, Uzbekistan, and Turkmenistan. This attack involved a UEFI bootkit that we dubbed BlackX. Having examined it, we found it to be similar to BlackLotus.

Attackers have been deploying BlackX after compromising the victim machine networks and obtaining administrator privileges. To install the bootkit, we observed them dropping the following files:

inst.exe , an installer executable

PVMDIJGKAX2 , an RC4-encrypted extensionless file containing files and strings required for the installation

The installer was launched with the command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1 . The last argument here is the RC4 key used for decryption.

Curiously, the file inst.exe does not contain any malicious strings or embedded blobs. All the files needed to install the malicious payload are inside PVMDIJGKAX2 , which makes it harder for incident responders to retrieve the bootkit components.

The installer package drops a set of files to both system and UEFI partitions, designed to exploit the Baton Drop vulnerability. We noted that the implementation of the exploit is remarkably similar to the one used in the BlackLotus malware. As with BlackLotus, the goal of the exploit is to install custom Machine Owner Keys (MOK), which allows loading arbitrary EFI files on the target machines to manipulate Secure Boot.

While the vulnerability exploitation chain was implemented very similarly to BlackLotus, we spotted differences between the exploits in BlackLotus and BlackX. That said, the source code of the BlackLotus bootkit has never been published online. This could mean that the attackers behind BlackX either reverse-engineered the BlackLotus bootkit or purchased its source code from cybercriminals. Either way, this is an interesting observation, as we rarely see APT actors borrow ideas or code from cybercrime actors.

The UEFI payload delivered during the Baton Drop exploitation has a classic bootkit goal — to inject a malicious driver into the Windows kernel. This driver differs from the one deployed by BlackLotus and is signed with a certificate belonging to an organization named 温江区明宇网络技术服务工作室 (English: Wenjiang District Mingyu Network Technology Service Studio). At the time of writing, this certificate (serial number: 0bcdf5e0da32d68900b8b7638459d072) has been revoked by its issuer.

The driver aims to tamper with security solutions installed on the machine. For example, it disables process, thread, and registry callbacks related to security solutions. It also tampers with ETW providers so that security solutions cannot access their output. Curiously, some of the tampering procedures are designed to run only if Kaspersky or Avast solutions are installed on the infected machine. However, during dynamic analysis of this driver, we found that these procedures are useless — they fail to interfere with Kaspersky products in any way.

The driver also protects the bootkit’s files from tampering. It intercepts kernel requests to open these files and returns a handle to calc.exe instead of a malicious file handle.

Apart from tampering with security solutions, the driver also deploys a user-mode payload. We observed two such payloads, used for cyberespionage, in the wild. One of them is a RAT that can load further-stage .NET payloads. This RAT uses cloud storage for C2 server communications — we observed its versions using Google Drive, OneDrive, and Yandex.Disk. Having connected to a cloud storage service, this RAT iterates over files available there and interprets them depending on the file suffix. Below is a list of supported suffixes:

We also observed another payload delivered through the bootkit, which we dubbed OxiDLLRunner. It is a malicious DLL obfuscated with OLLVM. It is loaded by the legitimate file googleupdate.exe (original filename: jcef_helper.exe , MD5: AF8A983B9ADA07EAE1259BF2953ABD40), which is also delivered by the bootkit. The DLL decrypts the contents of the file v8_context_snapshot.bin , which resides in the same folder, and then jumps to the beginning of the decrypted content. The decrypted data starts with shellcode followed by a PE file, which is a Rust payload designed to communicate with the www[.]archivetj[.]com C2 server. During communication, this payload is supposed to receive DLL files exporting a function named create_plugin , which are then executed in separate threads.

Based on the following facts, we have attributed this attack to the APT41 threat actor with medium confidence:

In June 2026, ESET published a blog post on attacks by the FishMonger threat actor, which the community assumes to be related to APT41. This post describes a kernel implant with a PDB path starting with C:\Users\ xdd \Desktop. While describing the campaign, the post also suggests the possible use of an unspecified UEFI bootkit component, which might exploit CVE‑2023‑24932. We observed the identifier “xdd” used multiple times in the BlackX bootkit payloads, so we assess that BlackX is the UEFI bootkit referenced in the ESET blog post;

The payloads deployed by BlackX are loaded using a legitimate executable abused via DLL sideloading, and an encrypted file — this pattern is common among Chinese-speaking threat actors;

The OxiDLLRunner file has been obfuscated with OLLVM, an obfuscator commonly used by Chinese-speaking actors.

During our initial analysis of BlackX, we thought that attackers succeeded in deploying it due to the negligence of the target organizations. Baton Drop, the vulnerability used to deploy BlackX, was disclosed back in 2023 and was patched, so we first thought that the infected machines lacked the relevant updates. However, our investigation proved this wrong — the targeted machines were fully patched.

Instead, we found out that the problem was with the patch itself. As it turned out, the patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components. However, this revocation does not happen automatically upon patch installation — the user has to trigger it manually . This is done with the following steps:

A registry flag is set inside HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot;

A scheduled task named Secure-Boot-Update is created.

This patch is designed to be applied manually — for instance, applying it automatically could break dual-boot systems relying on the “Windows Production PCA 2011” certificate to load. At the same time, this patch deployment practice creates a problem — as it is extremely unusual for a system administrator to take extra steps after installing an update. Usually, when applying patches, system administrators take no further action unless an installation failure occurs. These instructions for activating the patch are buried deep on the Microsoft website, and we assess that they are quite hard for an average IT administrator to notice.

Curiously, Microsoft’s plan for deploying the Baton Drop patches mentions an “Enforcement Phase” that involves revoking the “Windows Production PCA 2011” certificate automatically, without user interaction. At the time of publishing this post, this stage has not been implemented. On October 19, 2026, this certificate expired, but this does not prevent the vulnerable binaries from loading unless the certificate is blocklisted.

It is likely that the threat actor behind this campaign took into account that few organizations realized the importance of manually activating the Baton Drop patch. As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit.

Patch management is important for every organization, as updates from vendors help protect software and hardware against known vulnerabilities. However, sometimes installed patches fail to protect against the flaws they address. The BlackLotus story we described is not the only such example — for instance, in 2025 Microsoft released an update against the ToolShell vulnerability that also had to be applied manually.

However, modern security solutions are designed to account for such cases when installed patches fail to protect against security flaws for one reason or another. For instance, the Exploit Prevention component available in Kaspersky products prevents exploits from running if the patch is not applied, or if it is a zero-day vulnerability with no available patch. It is thus crucial to equip all machines in an organization with security solutions and constantly monitor the alerts they raise.

Malware Technologies

Malware Descriptions

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

This site uses Akismet to reduce spam. Learn how your comment data is processed.

GReAT Ideas. Balalaika Edition

GReAT Ideas. Green Tea Edition

GReAT Ideas. Powered by SAS: malware attribution and next-gen IoT honeypots

GReAT Ideas. Powered by SAS: threat actors advance on new fronts

GReAT Ideas. Powered by SAS: threat hunting and new techniques

From the same authors

Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports

PassiveNeuron: a sophisticated campaign targeting servers of high-profile organizations

Code highlighting with Cursor AI for $500,000

The GitVenom campaign: cryptocurrency theft using GitHub

Lazarus group evolves its infection chain with old and new malware

In the same category

Operation FlashHole: Lazarus breaks security, defies control

The journey of a paper unicorn: adventures inside a modern warehouse

Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

The Crypto Game of Lazarus APT: Investors vs. Zero-days

Grandoreiro, the global trojan with grandiose goals

臭名昭著的靴子套件回归了

由启动套件发射的有效载荷

用户模式第二级有效载荷

目标组织为何会受到感染？

2022年10月，卡巴斯基全球安全团队（Kaspersky GReAT）在调查一个黑客论坛上的奇特广告。一名网络犯罪分子以5000美元的价格出售一款名为“黑莲花”（BlackLotus）的UEFI启动套件，声称可以绕过安全启动（Secure Boot）。鉴于如此强大的功能却价格如此低廉，网络安全社区最初对此广告持怀疑态度。由于当时并未在实际环境中发现任何“黑莲花”样本，因此无人能够验证论坛帖子中的说法。

黑莲花广告

然而，大约半年后，即 2023 年 3 月，ESET 证实了 BlackLotus 的广告属实。研究人员追踪到了该启动工具包的样本，并确认它确实可以通过名为 Baton Drop (CVE-2022-21894) 的漏洞绕过安全启动。由于该漏洞在 2023 年仍然可利用，微软不得不发布多个安全更新来修复它。

自这些更新发布以来，BlackLotus引导工具包便销声匿迹——目前尚未有公开的攻击案例使用它。然而，在2026年初，我们发现了一个与BlackLotus类似的恶意软件样本，该样本曾被用于中亚地区的一次APT攻击活动中。在本报告中，我们将分享我们的发现，包括新的有效载荷以及对此次攻击活动的可能归因。

2026年初，我们发现了一起针对中亚国家（特别是塔吉克斯坦、乌兹别克斯坦和土库曼斯坦）外交机构的复杂APT攻击。此次攻击涉及一个我们称之为BlackX的UEFI启动工具包。经分析，我们发现它与BlackLotus类似。

攻击者在攻破受害者网络并获得管理员权限后，部署了 BlackX。我们观察到，为了安装引导程序，他们会投放以下文件：

inst.exe，一个安装程序可执行文件。

PVMDIJGKAX2，一个使用 RC4 加密的无扩展名文件，其中包含安装所需的文件和字符串。

安装程序通过命令行 C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1 启动。这里的最后一个参数是用于解密的 RC4 密钥。

奇怪的是，inst.exe 文件不包含任何恶意字符串或嵌入式数据块。安装恶意载荷所需的所有文件都位于 PVMDIJGKAX2 文件中，这使得事件响应人员更难检索到引导工具包组件。

安装程序包会在系统分区和 UEFI 分区中投放一组文件，旨在利用 Baton Drop 漏洞。我们注意到，该漏洞的实现方式与 BlackLotus 恶意软件中使用的漏洞非常相似。与 BlackLotus 一样，该漏洞的目标是安装自定义机器所有者密钥 (MOK)，从而允许在目标机器上加载任意 EFI 文件以操纵安全启动。

虽然漏洞利用链的实现方式与 BlackLotus 非常相似，但我们发现 BlackLotus 和 BlackX 的漏洞利用方式存在差异。值得一提的是，BlackLotus 引导工具包的源代码从未在网上公开。这可能意味着 BlackX 背后的攻击者要么对 BlackLotus 引导工具包进行了逆向工程，要么从网络犯罪分子手中购买了其源代码。无论如何，这都是一个有趣的发现，因为我们很少看到 APT 组织借鉴网络犯罪分子的思路或代码。

在 Baton Drop 攻击中投放的 UEFI 有效载荷具有典型的引导工具包目标——将恶意驱动程序注入 Windows 内核。该驱动程序与 BlackLotus 部署的驱动程序不同，并且使用名为“温江区明宇网络技术服务工作室”的组织颁发的证书进行签名。截至撰写本文时，该证书（序列号：0bcdf5e0da32d68900b8b7638459d072）已被其颁发机构吊销。

该驱动程序旨在篡改计算机上安装的安全解决方案。例如，它会禁用与安全解决方案相关的进程、线程和注册表回调。它还会篡改 ETW 提供程序，使安全解决方案无法访问其输出。奇怪的是，某些篡改程序似乎仅在受感染的计算机上安装了 Kaspersky 或 Avast 解决方案时才会运行。然而，在对该驱动程序进行动态分析的过程中，我们发现这些程序毫无用处——它们根本无法干扰 Kaspersky 产品。

该驱动程序还能保护启动工具包的文件免遭篡改。它会拦截内核打开这些文件的请求，并返回 calc.exe 的句柄，而不是恶意文件句柄。

除了篡改安全解决方案外，该驱动程序还会部署用户模式有效载荷。我们在实际环境中发现了两个用于网络间谍活动的此类有效载荷。其中一个是远程访问木马 (RAT)，可以加载更高级别的 .NET 有效载荷。该 RAT 使用云存储进行 C2 服务器通信——我们观察到它使用了 Google Drive、OneDrive 和 Yandex.Disk 等云存储版本。连接到云存储服务后，该 RAT 会遍历其中的文件，并根据文件后缀对其进行解析。以下是支持的后缀列表：

我们还观察到另一个通过引导工具包传播的有效载荷，我们将其命名为 OxiDLLRunner。这是一个使用 OLLVM 混淆的恶意 DLL。它由合法文件 googleupdate.exe（原始文件名：jcef_helper.exe，MD5：AF8A983B9ADA07EAE1259BF2953ABD40）加载，该文件也由引导工具包传播。该 DLL 会解密位于同一文件夹中的 v8_context_snapshot.bin 文件的内容，然后跳转到解密内容的开头。解密后的数据以 shellcode 开头，后跟一个 PE 文件，这是一个 Rust 有效载荷，旨在与 www[.]archivetj[.]com C2 服务器通信。在通信过程中，该有效载荷会接收导出名为 create_plugin 的函数的 DLL 文件，这些文件随后会在单独的线程中执行。

基于以下事实，我们以中等置信度将此次攻击归因于 APT41 威胁组织：

2026年6月，ESET发布了一篇博文，介绍了FishMonger威胁组织发起的攻击，该组织被社区普遍认为与APT41有关。这篇博文描述了一个内核植入程序，其PDB路径以C:\Users\xdd\Desktop开头。在描述此次攻击活动的同时，博文还暗示可能使用了未指定的UEFI启动工具包组件，该组件可能利用了CVE-2023-24932漏洞。我们观察到BlackX启动工具包的有效载荷中多次使用了标识符“xdd”，因此我们判断BlackX就是ESET博文中提到的UEFI启动工具包。

BlackX 部署的有效载荷是通过滥用合法可执行文件（通过 DLL 侧加载）和加密文件加载的——这种模式在讲中文的威胁行为者中很常见；

OxiDLLRunner 文件已使用 OLLVM 进行混淆，OLLVM 是中文攻击者常用的一种混淆器。

在对 BlackX 进行初步分析时，我们认为攻击者之所以能够成功部署该漏洞，是因为目标机构存在疏忽。用于部署 BlackX 的 Baton Drop 漏洞早在 2023 年就已披露并修复，因此我们最初认为受感染的机器缺少相关的更新。然而，我们的调查证明这种想法是错误的——目标机器实际上已经完全安装了补丁。

然而，我们发现问题出在补丁本身。原来，Baton Drop漏洞的补丁旨在撤销用于签署易受攻击的UEFI组件的“Windows Production PCA 2011”证书。但是，此撤销操作不会在安装补丁后自动执行，用户必须手动触发。具体步骤如下：

在 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot 中设置注册表标志；

创建了一个名为 Secure-Boot-Update 的计划任务。

此补丁设计为手动应用——例如，自动应用可能会导致依赖“Windows Production PCA 2011”证书加载的双启动系统出现故障。同时，这种补丁部署方式也存在问题——系统管理员在安装更新后采取额外步骤的情况极为罕见。通常情况下，除非安装失败，否则系统管理员在应用补丁时不会采取任何进一步行动。激活此补丁的说明隐藏在微软网站的深处，我们认为普通 IT 管理员很难注意到它们。

奇怪的是，微软在部署 Baton Drop 补丁的计划中提到了一个“强制执行阶段”，该阶段涉及在无需用户交互的情况下自动吊销“Windows Production PCA 2011”证书。截至本文发布时，该阶段尚未实施。该证书已于 2026 年 10 月 19 日过期，但这并不能阻止存在漏洞的二进制文件加载，除非该证书被列入黑名单。

此次攻击活动的幕后黑手很可能考虑到很少有组织意识到手动激活 Baton Drop 补丁的重要性。因此，我们认为他们决定投入时间研究 BlackLotus 的工作原理，并制作一个仿制该启动工具包的副本。

补丁管理对每个组织都至关重要，因为供应商提供的更新有助于保护软件和硬件免受已知漏洞的侵害。然而，有时已安装的补丁并不能抵御它们所修复的漏洞。我们之前提到的 BlackLotus 案例并非个例——例如，微软在 2025 年发布了一个针对 ToolShell 漏洞的更新，但该更新也需要手动安装。

然而，现代安全解决方案旨在应对已安装补丁因各种原因无法抵御安全漏洞的情况。例如，卡巴斯基产品中的漏洞利用防护组件可以阻止未应用补丁或无可用补丁的零日漏洞的攻击。因此，为组织内的所有机器配备安全解决方案并持续监控其发出的警报至关重要。

恶意软件技术

恶意软件描述

APT41如何复活黑莲花入侵工具包，攻击中亚外交机构

本网站使用 Akismet 来减少垃圾邮件。了解您的评论数据如何处理。

伟大的想法。巴拉莱卡版

绝妙创意。绿茶版

GReAT Ideas。由 SAS 提供支持：恶意软件归因和下一代物联网蜜罐

GReAT Ideas。由 SAS 提供支持：威胁行为者在新战线上不断扩张

GReAT Ideas。由 SAS 提供支持：威胁狩猎和新技术

出自同一作者之手

“论坛巨魔行动”仍在继续：俄罗斯政治学家成为抄袭举报攻击目标

PassiveNeuron：一项针对知名组织服务器的复杂攻击活动

利用光标AI实现代码高亮显示，价值50万美元

GitVenom 活动：利用 GitHub 进行加密货币盗窃

Lazarus 组织利用新旧恶意软件不断演变其感染链。

同一类别

“闪光洞行动”：拉撒路突破安全防线，无视控制

纸独角兽的旅程：现代仓库里的奇遇

加密货币投资浪费：BlueNoroff 的融资和就业幻影

拉撒路APT的加密货币博弈：投资者对抗零日漏洞

Grandoreiro，这个拥有宏大目标的全球特洛伊木马