BlackX UEFI bootkit hits Central Asian diplomats, bypasses Secure Boot

2026-10-25 · Cybersecurity · Tajikistan · Uzbekistan

Diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan were targeted in early 2026 by a new UEFI bootkit called BlackX, an espionage campaign suspected to be run by a China-linked state-sponsored group. BleepingComputer reported the bootkit exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. The attacks worked on patched Windows systems that were still missing the relevant revocations, meaning updated machines were not automatically safe. Bootkits sit below the operating system, making them hard to detect and remove, and this campaign shows firmware-level persistence being used against government targets.

Why it matters：Firmware-level malware that survives patched systems challenges standard endpoint defense and highlights how revocation management gaps leave even updated machines exposed.

Key points

• Targets included diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan.
• The bootkit abused the old Baton Drop flaw to defeat Secure Boot.
• It loaded a driver meant to interfere with Kaspersky and Avast security tools.

Sources (original reporting)

• The Hacker News
• BleepingComputer

More stories from this day

• Leaked LiteLLM master key led to malicious package release
• Brotli decoder flaw enables RCE in Node.js, Bun and Python
• CISA flags exploited Collabora and Arista VCO flaws
• FCC bans two devices with HiSilicon surveillance chips
• Critical PHP bugs expose web's fragility as AI speeds up exploitation
• Credit markets spooked by 'total meltdown' in riskiest debt; metals traders post record profits