Kaspersky GReAT published medium-confidence attribution on October 22 linking BlackX, a UEFI bootkit active against Central Asian diplomatic targets, to APT41, the Chinese state-aligned threat group also tracked as Winnti and Double Dragon. The attribution rests on overlapping tooling, C2 infrastructure reuse, and targeting patterns consistent with APT41's documented foreign-intelligence collection mandate. Three confirmed victim categories are Uzbek, Tajik, and Turkmen diplomatic organizations.
The BlackX bootkit exploits CVE-2022-21894, the vulnerability known as Baton Drop. Microsoft patched the underlying Windows Boot Manager flaw in January 2023. The Secure Boot revocation that should prevent exploitation of this patched code requires a separate action: distributing an updated DBX (Secure Boot Forbidden Signature Database) revocation list to endpoints. Microsoft has not shipped that update to all endpoints. On systems where DBX was not explicitly refreshed after August 2024, CVE-2022-21894 remains exploitable regardless of Windows patch level.
How Baton Drop still works in 2026
Secure Boot relies on two databases: an allowlist (DB) of trusted bootloaders and a blocklist (DBX) of revoked signatures. When Microsoft ships a patch for a Boot Manager vulnerability, the fix prevents new copies of the vulnerable binary from running, but it does not automatically revoke signatures for copies already in circulation. Revoking those signatures requires shipping an updated DBX, a step taken separately because pushing a malformed revocation list can brick hardware. Microsoft ships DBX updates on a conservative schedule and does not push them automatically through Windows Update in all configurations. BlackX loads a copy of the old, vulnerable Boot Manager whose signature is absent from the current DBX on most targets, then exploits CVE-2022-21894 to bypass Secure Boot and load an unsigned UEFI module.
The Uzbekistan connection
Kaspersky's report identifies the Uzbek Ministry of Foreign Affairs and two unnamed Uzbek embassies as confirmed targets based on C2 beacon telemetry. Tajikistan and Turkmenistan are also named. The geographic clustering is consistent with Chinese Belt and Road diplomatic monitoring tasking. Command-and-control infrastructure uses Yandex.Disk as a dead-drop resolver, routing initial check-ins through the Russian cloud storage service to blend with legitimate regional network traffic. Kaspersky observed this Yandex.Disk pattern in prior APT41 operations across CIS countries in 2024.
Detection and mitigation
- Run Get-SecureBootPolicy on all Windows endpoints and compare the DBX LastUpdateTime field against 2024-08-13. Any endpoint with an earlier date requires manual update.
- Apply the August 2024 Secure Boot revocation update (KB5025885 plus device manufacturer firmware updates). This update is not delivered automatically via Windows Update on all hardware configurations.
- Audit outbound connections to Yandex.Disk (disk.yandex.com, api.disk.yandex.net) from server and embassy-network assets. Legitimate Yandex.Disk traffic is uncommon in corporate environments outside CIS-based organizations.
- Monitor UEFI event logs for unsigned module load events. Windows Defender Credential Guard and Virtualization Based Security may generate alerts on affected systems.
Kaspersky classifies the attribution as medium confidence. Indicators of compromise including UEFI module hashes, Yandex.Disk beacon URLs, and BIOS-level persistence mechanisms are available in the Kaspersky Threat Intelligence portal and via the GReAT October 22 technical report.
Gigia Tsiklauri is the founder and editor of infosec.ge. Get in touch.