Based on information from The Hacker News, diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan have been targeted by a sophisticated Unified Extensible Firmware Interface bootkit known as BlackX.
Kaspersky researchers identified the campaign, which is suspected to be the work of the China-linked Advanced Persistent Threat group APT41. BlackX functions as an updated version of the BlackLotus bootkit, designed to undermine Windows startup defenses and bypass Secure Boot. The malware exploits the Baton Drop vulnerability, CVE-2022-21894, by capitalizing on organizations that failed to manually apply necessary Secure Boot revocation mitigations. Once attackers gain administrative access, they deploy the bootkit to maintain long-term, covert persistence. The payload injects a malicious driver into the Windows kernel to disable endpoint security software and deploy espionage tools, including a remote access trojan and a malicious DLL. These tools leverage cloud services like Google Drive and OneDrive for command-and-control communication to evade detection. The use of specific strings and DLL sideloading techniques links the activity to the broader APT41 ecosystem. This incident highlights the critical need for organizations to perform manual security updates beyond standard patching to protect against firmware-level threats that can compromise the entire operating system stack.
Source: The Hacker News
