BlackX: APT41-Associated UEFI Bootkit Bypassing Secure Boot via Baton Drop

BlackX is a UEFI bootkit that exploits a vulnerability in Windows systems to bypass Secure Boot and load malicious code. This bootkit was recently observed targeting diplomatic organizations in Central Asian countries, including Tajikistan, Uzbekistan, and Turkmenistan. The attackers gain administrative privileges on the target system, then install the bootkit and establish persistence on the compromised machine.

The bootkit registers a custom Machine Owner Key (MOK) in the UEFI variables, allowing it to load arbitrary EFI binaries. This enables the attackers to inject a signed malicious driver into the Windows kernel, which can interfere with security product callbacks and conceal the bootkit's presence. The malicious driver returns a handle to calc.exe for open requests, making it difficult to detect the bootkit's files.

The bootkit can also deploy a Remote Access Trojan (RAT) that uses cloud storage services for command and control (C2) communications, or it can load a payload called OxiDLLRunner. This payload is loaded through DLL sideloading and executes a Rust payload that can receive and execute additional DLL plugins. The attackers have attributed this activity to the APT41 threat group with medium confidence, based on similarities in their techniques, but this does not confirm direct involvement by the Chinese government.