DEV Community

Anoymask
Anoymask

Posted on

BlackX: APT41-Associated UEFI Bootkit Bypassing Secure Boot via Baton Drop

#security #threatintel

1. Basic Information

2. Executive Summary

BlackX is a UEFI bootkit that exploits CVE-2022-21894 (Baton Drop) on compromised Windows systems to register a custom Machine Owner Key (MOK) and load arbitrary EFI binaries. Kaspersky observed this activity in early 2026 targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Attribution to APT41 is made with medium confidence and does not prove direct involvement by the Chinese government.

3. Attack Flow

Observed Deployment and Sample Analysis Findings

The following steps outline the post-compromise deployment observed by Kaspersky and the capabilities identified through sample analysis. This does not establish that every capability was executed on every victim system.

  1. The attacker breaches the target network and obtains administrator privileges on the target Windows system (the initial access method is not publicly disclosed).
  2. The installer inst.exe and an RC4-encrypted extensionless container PVMDIJGKAX2 are placed in C:\ProgramData\Intel\. Separating strings and payloads from the main installer makes analysis more difficult.
  3. CVE-2022-21894 (Baton Drop) is exploited to register a custom MOK in UEFI variables, load an arbitrary EFI binary, and inject a signed malicious driver into the Windows kernel.
  4. The driver interferes with process, thread, and registry callbacks associated with security products, as well as ETW providers. Furthermore, it returns a handle to calc.exe for open requests targeting bootkit files, thereby concealing their existence.
  5. As user-mode payloads, it deploys either a RAT that uses Google Drive, OneDrive, or Yandex.Disk for C2 and can load .NET payloads, or OxiDLLRunner launched via DLL sideloading.
  6. OxiDLLRunner decrypts v8_context_snapshot.bin to execute a Rust payload. This payload includes functionality to receive and execute DLL plugins with a create_plugin export from www[.]archivetj[.]com (individual plugin execution results on victim endpoints were not specified).
Phase Attacker Action / Technique Tools & Communications Defender Indicators (Conditions & Artifacts)
Initial Compromise & Privilege Escalation Breaches the target network and obtains administrator privileges on the target Windows system (initial access method not disclosed) Not publicly disclosed (initial access and remote execution methods have not been disclosed) Administrator sessions, remote execution logs, suspicious authentication artifacts (Condition: Initial access and local administrator privilege acquisition)
Secure Boot Bypass & Persistence Exploits Baton Drop (CVE-2022-21894) to register a custom MOK and load an arbitrary EFI binary inst.exe, PVMDIJGKAX2, vulnerable Windows Boot Manager, malicious EFI binary EFI System Partition (ESP) file changes, modification artifacts of MOK and Secure Boot variables (Condition: Vulnerable bootloader not revoked via DBX)
Kernel Intervention & Defense Evasion Injects a signed malicious driver into the Windows kernel to obstruct monitoring callbacks and spoof handles during file open requests Signed malicious driver (Certificate Serial: 0bcdf5e0da32d68900b8b7638459d072) Driver load events, EDR/ETW provider anomalies, discrepancies between files recovered from offline disk images and live acquisition results (substitution with calc.exe), or handle spoofing confirmed via driver analysis (Condition: Successful bootkit startup)
Espionage & C2 Communications A RAT uses legitimate cloud storage for C2 and can load .NET payloads. Alternatively, OxiDLLRunner is loaded through DLL sideloading and launches a Rust payload that can receive and execute additional DLL plugins. googleupdate.exe, OxiDLLRunner, v8_context_snapshot.bin, legitimate cloud storage APIs, www[.]archivetj[.]com Access to legitimate cloud storage from anomalous processes, DLL sideloading artifacts, communications to archivetj[.]com by the Rust payload (Condition: Execution of user-mode payloads and established external communication)

4. Attacker Position and Execution Environment

  • In the initial phase, the attacker has already breached the victim network and obtained administrator privileges on the target system.
  • The bootkit operates in the EFI System Partition (ESP) and boot chain, the driver operates in the Windows kernel, and the RAT and OxiDLLRunner operate in user mode.
  • Kaspersky attributed the activity to APT41 with medium confidence. This attribution is based on shared characteristics such as the xdd identifier, DLL sideloading, and OLLVM obfuscation. These similarities do not establish the operators' identities, and links to Chinese-speaking actors do not prove Chinese government involvement.

5. Victim and Administrator Perspective

Victims

  • Espionage payloads may run while Windows appears to boot normally, without obvious on-screen indications or warnings.
  • Because legitimate cloud storage is abused for C2, activity may blend in with ordinary business traffic.

Administrators and SOCs

  • Standard OS-level forensic investigations risk overlooking UEFI partition modifications, custom MOK registrations, unrevoked boot manager states, and kernel callback interference.
  • inst.exe, PVMDIJGKAX2, googleupdate.exe, OxiDLLRunner, v8_context_snapshot.bin, and the signing certificate serial number 0bcdf5e0da32d68900b8b7638459d072 can serve as investigation starting points.
  • Note that the signing certificate for this malicious driver was already revoked by the issuer by the time Kaspersky published its report.

6. Conditions for Success and Failure

Success Conditions

  • The attacker has previously compromised the target network and acquired local administrator privileges on the Windows system.
  • Boot components vulnerable to CVE-2022-21894 are not blocked by dbx, and Windows Production PCA 2011 revocation measures are not enforced.
  • Modifications to the EFI System Partition (ESP), registration of a custom MOK, and deployment of the bootkit via reboot are not blocked by defensive controls.

Failure Conditions and Mitigations

  • Follow Microsoft KB5025885 to test on representative devices, verify updates to 2023 certificates and corresponding boot managers, and then apply Windows Production PCA 2011 DBX revocation measures and SVN updates in stages. Prior to deployment, ensure updated recovery and boot media as well as BitLocker recovery keys are secured, and check for known compatibility issues with firmware or disk encryption products.
  • Do not assume completion based solely on OS updates, registry flag settings, or task execution. Verify the actual DB/DBX variable state and check event logs indicating that revocation has been applied, such as Event ID 1037.
  • Monitor modifications to UEFI, MOK, and boot entries, and promptly block unauthorized use of administrator privileges.
  • Detect and block known malicious driver certificates, suspicious file drops, suspicious domains, and C2 activity abusing legitimate cloud storage.

7. What Happens Upon Success

  • The bootkit persists prior to OS startup, and a malicious kernel driver is injected.
  • Interference with security product callbacks and ETW providers may significantly reduce visibility for EDR and similar tools. During dynamic analysis, Kaspersky found that certain procedures designed to target Kaspersky or Avast products failed to interfere with Kaspersky products.
  • The payloads support .NET payload execution, file upload/download, system information collection, and the receipt and execution of additional DLL plugins.

8. Observable Logs

Email

  • No specific email-based initial access vector has been publicly disclosed for this incident.

Proxy / SWG / DNS

  • Monitor for traffic to www[.]archivetj[.]com and API usage of Google Drive, OneDrive, or Yandex.Disk by unexpected processes.
  • Do not immediately declare traffic malicious based solely on legitimate cloud storage usage; correlate it with file, process, and account information on the endpoint.

Endpoint / EDR

  • Check for creation and execution events of C:\ProgramData\Intel\inst.exe, PVMDIJGKAX2, googleupdate.exe, OxiDLLRunner, and v8_context_snapshot.bin.
  • Investigate the UEFI System Partition, MOK variables, Secure Boot variables, boot entries, driver loads, and registration anomalies in monitoring callbacks or ETW providers.
  • Investigate handle substitution by comparing live-response acquisition results with the actual files in offline disk images. Use driver analysis or runtime evidence to confirm that requests to open bootkit files are redirected to a handle for calc.exe.

Identity / IdP

  • Check for suspicious grants or usage of local administrator privileges, execution of remote management tools, unauthorized use of service accounts, and anomalous authentication events associated with lateral movement.

SaaS / Cloud

  • Correlate suspicious OAuth app and token usage and file operation histories in Google Drive, OneDrive, or Yandex.Disk with RAT execution timestamps on endpoints.

Network

  • Trace chronologically from network intrusion, device administrator privilege theft, bootkit staging, and system reboot to cloud storage and archivetj communications.

9. Attack Success Assessment

Confirmed in Public Information

  • Kaspersky identified BlackX in early 2026 within real-world attack environments targeting diplomatic organizations in three Central Asian countries.
  • Target devices had fully applied OS updates, but Windows Production PCA 2011 revocation measures had not been automatically applied, leaving them able to load vulnerable boot managers.
  • Attribution to APT41 is made with medium confidence. Direct instructions or involvement by the Chinese government and the exact scope of compromise across victim organizations cannot be determined solely from public information.

Self-Assessment Criteria

  • Record malicious EFI binaries or MOK variable modifications related to BlackX as deployment artifacts. Confirm successful execution through evidence such as loading of the associated EFI binary during reboot or execution of the corresponding malicious driver as part of that boot chain. Do not judge success based solely on configuration changes or matching file names.
  • Do not assume C2 success based only on cloud storage access or domain name resolution; evaluate by cross-referencing RAT processes, task instruction files, result files, and plugin execution.

10. Investigation Playbook

  1. Follow the steps in Microsoft KB5025885 to check the application status of 2023 certificates, corresponding boot managers, DBX revocations, and SVN. Do not conclude revocation is complete simply because the Secure-Boot-Update task executed or registry flags exist.
  2. Acquire an offline image of the EFI System Partition (ESP) and compare the deployed EFI files against a known good baseline. Additionally, acquire and preserve UEFI variables such as MOK and boot entries separately for cross-referencing (note that ESP imaging alone does not preserve variables).
  3. Preserve related files under C:\ProgramData\Intel\, driver signing certificates, and the DLL sideloading chain.
  4. Cross-reference EDR, Windows event logs, firmware telemetry, and network logs to trace the initial access path prior to administrator privilege acquisition.
  5. Verify file operations, token activity on cloud storage accounts, and communication history with www[.]archivetj[.]com.
  6. Physically or logically isolate devices suspected of bootkit infection from the network immediately and conduct evidence preservation. If infection is confirmed, rebuild the entire system—including the OS and ESP—to a trusted clean state, and verify UEFI setting integrity. If firmware tampering is suspected, assess whether further action is needed under OEM procedures.

11. Defense and Detection Ideas

  • Go beyond simply tracking OS patch application rates by adding the enforcement status of Secure Boot revocation updates to asset management items for tracking.
  • Establish baselines for the contents of the EFI System Partition, MOK and boot variables, and boot manager hashes, and set up alerts to detect modifications.
  • Monitor the use of legitimate cloud storage by process, account, and file suffix to detect repetitive polling and file uploads/downloads (including small instruction and result files) by unknown processes.
  • Eliminate the persistent use of local administrator privileges and strengthen privileged access management, application control, and driver allowlisting.
  • Even if files appear normal in a live response environment, account for handle-spoofing concealment by malicious drivers by combining offline image comparisons with driver analysis.

12. Facts / Inference / Hypothesis

Facts

  • BlackX exploits CVE-2022-21894 to register a custom MOK, allowing arbitrary EFI binaries to load.
  • Kaspersky reported that this technique was exploitable because Windows Production PCA 2011 revocation measures were not automatically applied even on fully updated devices.
  • Malicious kernel drivers obstruct security product callbacks and ETW, and spoof open requests for bootkit files to point to calc.exe handles.
  • The RAT abuses Google Drive, OneDrive, and Yandex.Disk for C2 communications, and OxiDLLRunner uses DLL sideloading and encrypted payloads.
  • Kaspersky attributed this attack activity to APT41 with medium confidence.

Inference

  • Windows environments where administrative privilege theft coincides with unapplied Secure Boot revocations face potential targeting using similar techniques, extending beyond diplomatic organizations.
  • For organizations permitting the use of legitimate cloud storage for business, detailed correlation analysis across processes, accounts, and file operations is essential, beyond mere domain blocking.

Hypothesis

  • No additional hypotheses. Initial access methods, the full scope of victims, and specific command relationships between APT41 and state authorities remain unconfirmed matters.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1542.003 Pre-OS Boot: Bootkit high Bypasses Secure Boot as a UEFI bootkit and injects drivers into the Windows kernel.
T1685 Disable or Modify Tools high Features capabilities to obstruct security callbacks and ETW providers (does not universally indicate success across all products).
T1574.001 Hijack Execution Flow: DLL high Executes OxiDLLRunner via DLL sideloading by abusing googleupdate.exe.
T1102 Web Service high Uses legitimate cloud services such as Google Drive, OneDrive, and Yandex.Disk as C2.
T1105 Ingress Tool Transfer high Implements functionality in the RAT and Rust payload to retrieve additional files and DLL plugins (distinguished from actual acquisition success on individual endpoints).

14. Unresolved Points and Further Investigation

  • Initial access paths, methods for acquiring administrator privileges, specific numbers of victim organizations, and the scope of data actually exfiltrated.
  • Independent forensic evidence reinforcing the attribution to APT41 (medium confidence), and whether there was direct direction or involvement by the Chinese government.
  • The timing when Microsoft's Enforcement Phase was actually applied to managed devices, and its impact on dual-boot environments.

15. Impact on SOCs and Organizations

Organizations should not assume that keeping Windows up to date completes Baton Drop mitigation. The enforcement status of Secure Boot revocation updates must be audited on a per-device and per-asset basis, and the firmware and boot chain must be recognized and managed as blind spots outside EDR visibility. Treat this threat appropriately as a long-term persistence mechanism should administrative privileges ever be compromised, regardless of whether the organization belongs to diplomatic, government, telecommunications, or critical infrastructure sectors.

16. Audience-Specific Summary

  • SOC: Correlate changes to UEFI partitions, MOKs, and boot entries, driver loads, C2 communications via cloud storage, and traffic to archivetj against the timeline of administrator privilege acquisition and system reboots.
  • Administrators: Thoroughly verify hardware compatibility and recovery mechanisms (BitLocker recovery keys and updated media), apply Secure Boot revocation updates according to official Microsoft procedures, and validate the active state of DB/DBX. Do not assume completion simply based on an indication that OS patches are applied.
  • General Users: In addition to performing regular Windows Updates, promptly carry out reboots and Secure Boot-related updates instructed by your organization's system administrators without delay.

Top comments (0)