What happened
In early 2026, diplomatic entities in Central Asia, specifically located in Tajikistan, Uzbekistan, and Turkmenistan, have been targeted by a new sophisticated UEFI bootkit named BlackX. This malware specifically targets Microsoft Windows systems and is capable of bypassing secure boot protections, which are designed to prevent unauthorized firmware modifications. The BlackX bootkit was reported to have been used in targeted attacks, with the potential for persistent low-level system compromise that could evade standard security measures. The activity is suspected to involve a China-linked state-sponsored hacking group identified as APT41, according to reports from Kaspersky. The vulnerability exploited by BlackX hinges on the Windows operating system's circumstances where secure boot has not been properly revoked or where the bootkit bypasses such protections, allowing persistent malicious presence at the firmware level, which complicates detection and removal.
Who is affected
Organizations operating Windows-based systems that are potentially unpatched against the specific vulnerabilities exploited by BlackX are at risk. Particularly, affected deployments are those where secure boot protections have been bypassed or not revoked following certain system modifications or updates. Given the targeted nature of the activity, diplomatic organisations and entities in Central Asia are believed to be primary targets, although other entities using affected Windows configurations may also be vulnerable to similar attacks.
Recommended actions
- Review the status of secure boot configurations on Windows systems, ensuring that protections are enabled and properly enforced where applicable.
- Investigate system firmware integrity, especially on endpoints suspected of being targeted, to confirm whether malicious modifications or persistent bootkits are present.
- Implement measures to prevent unauthorized bypassing of secure boot via firmware-level controls, particularly on systems where updates or configurations might have affected firmware security settings.
