Kaspersky examines BlackX bootkit targeting diplomatic organisations

Kaspersky says it identified a UEFI bootkit called BlackX in a campaign targeting diplomatic organisations in Central Asia. The research highlights updates and Secure Boot configuration in defending against threats that run before the operating system starts.

Dji Banner Inside Article - 728x90

Administrator access comes first

Kaspersky identified BlackX in targeted attacks observed in early 2026. It reports similarities with BlackLotus and exploitation of the Secure Boot weakness known as Baton Drop. The bootkit is not described as a tool that can be remotely installed on every machine in one step.

A key detail is that attackers had already compromised target networks and obtained administrator privileges before installation. Initial access, privileged-account protection and early detection therefore remain important defensive concerns. Components running before the operating system can then complicate persistence and visibility.

Secure Boot and the update chain

Secure Boot checks trusted software during startup. The BlackX research concerns risks involving older vulnerable components in that chain. Alongside Microsoft’s updates, the relevant deployment and configuration steps need to be completed; simply seeing an update name does not establish identical protection in every environment.

Kaspersky reports payloads intended to interfere with security software, while noting that security products blocked some attempts. The focus here is defensive understanding rather than instructions for installing the malware or bypassing protections.

Attribution remains an assessment

The company links the campaign to APT41 with medium confidence. That is a technical assessment, not a definitive judicial finding. The report also discusses additional espionage components using services including Google Drive, OneDrive and Yandex Disk. Abuse of a legitimate cloud service does not mean its provider was breached.

The findings were presented at Security Analyst Summit 2026 in Bali. For organisations, the important themes are restricting administrator access, completing vendor update guidance and examining boot integrity during incident response. The accompanying press-release image is an illustration of the threat.

Sources and further information: Securelist BlackX research.