Kaspersky has uncovered a sophisticated cyberthreat targeting diplomatic organizations in Central Asia, with its Global Research and Analysis Team (GReAT) identifying a new bootkit known as BlackX. The malware exploits a weakness in the implementation of a Microsoft security update to bypass Windows startup protections and establish persistent, stealthy access to compromised devices.
Kaspersky attributed the campaign to the APT41 group with moderate confidence, describing BlackX as a modernized successor to the notorious BlackLotus bootkit.
In early 2026, Kaspersky security solutions blocked an APT attack targeting diplomatic organizations in Central Asia. Subsequent research by GReAT revealed that the attackers had deployed BlackX, a sophisticated malware designed to evade Windows startup defenses and numerous third-party security solutions.
BlackX Exploits a Microsoft Security Update Gap
The investigation found that BlackX builds on an implant known as BlackLotus, which was offered for sale on the dark web by cybercriminals in 2022. The malware can bypass Windows Secure Boot by exploiting the previously identified “Baton Drop” vulnerability.
Although Microsoft released a patch for the flaw, organizations must manually complete additional configuration steps to fully activate the protection. Systems that have received the update but have not completed these steps may remain vulnerable, allowing attackers to exploit the weakness despite the patch being installed.
Malware Designed to Disable Security Tools
The attackers deployed BlackX as a secondary, persistent threat after gaining access to victims’ internal networks and obtaining administrative privileges on Windows machines. They used encrypted files and custom installer programs to deliver the malware while attempting to avoid detection by incident response teams.
Once the exploit succeeds, BlackX deploys a component designed to disable security software. Kaspersky’s endpoint protection blocked the malware’s attempt to disable its defenses, causing the attack to fail.
Had the attackers succeeded, they would have proceeded to deploy spyware that abuses legitimate cloud services, including Google Drive, OneDrive and Yandex Disk, to steal confidential information and monitor victims’ activities.
Georgy Kucherin, a security expert at Kaspersky GReAT, said the emergence of BlackX was notable because advanced persistent threat groups rarely borrow code or concepts directly from cybercrime tools such as BlackLotus.
He explained that adapting a commercially available cybercrime tool enabled the attackers to circumvent protections designed to secure the Windows boot process, demonstrating how sophisticated threat actors can repurpose existing malware to gain persistent and covert access to high-value networks.
Kaspersky Recommends Strengthening Boot Security
Kaspersky recommends that organizations ensure their IT teams manually complete Microsoft’s recommended configuration steps to address the Baton Drop vulnerability and similar weaknesses.
Organizations should also limit administrative privileges and deploy security solutions capable of monitoring firmware integrity. Kaspersky added that its Exploit Prevention component can block exploits even when a security patch has not been installed or when attackers exploit a zero-day vulnerability for which no patch is available.
The research was presented at the Security Analyst Summit 2026 in Bali, Indonesia.
