Kaspersky links BlackX UEFI bootkit to attacks on Central Asian diplomatic targets

Past-week coverage · Original source published 2026-10-23.

Diplomatic organizations in Central Asia were targeted with a new UEFI bootkit that Kaspersky calls BlackX, according to a technical report the vendor published. The activity singled out diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026.

Kaspersky suspects the campaign was orchestrated by a China-linked state-sponsored group tracked as APT41. That attribution is the vendor's assessment, not a confirmed finding, and the report as summarized does not lay out the evidence behind it.

The headline claim is about Secure Boot. BlackX is described as bypassing the firmware security check on Windows systems that are patched but missing revocations. In other words, the weakness appears to sit in what a machine has been told to distrust rather than in an unpatched operating system. The source does not detail the affected firmware, the revocation list involved, or which Windows versions are exposed, so defenders should treat those specifics as open questions.

Why it matters

A bootkit that loads before the operating system can hide from tools that only start once Windows is running. For organizations that handle diplomatic or government work, that raises the value of firmware-level visibility and of tracking whether revocation updates actually reached endpoints, not just whether patches were installed.

What defenders can do

• Confirm that Secure Boot revocation updates are applied across fleets, including laptops that travel or sit offline.
• Monitor firmware integrity and boot behavior where tooling allows it.
• Treat suspected bootkit compromise as a reimaging decision, not a cleanup task.

The source gives no indicators of compromise, no exploitation steps and no fix.