Executive Summary
In early 2026, Kaspersky GReAT uncovered a sophisticated APT campaign attributed with medium confidence to APT41 (FishMonger), targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a UEFI bootkit dubbed BlackX—a reverse-engineered or purchased derivative of the BlackLotus bootkit—exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot on fully patched machines. Post-exploitation payloads included a cloud-storage-based RAT communicating over Google Drive, OneDrive, and Yandex.Disk, and a Rust-based implant (OxiDLLRunner) for plugin-based command execution, enabling persistent kernel-level espionage against high-value diplomatic targets.
This incident highlights a dangerous patch-activation gap: Microsoft's CVE-2022-21894 fix requires manual registry and scheduled-task steps most administrators never take. As APT groups increasingly borrow cybercriminal tooling and exploit dormant patch gaps, organizations running unactivated UEFI mitigations across hybrid and cloud-connected endpoints face heightened espionage risk in 2026 and beyond.
Why This Matters Now
Microsoft's Baton Drop patch has never entered its automatic 'Enforcement Phase,' leaving millions of nominally patched Windows systems still vulnerable to UEFI-level compromise. With APT41 now weaponizing this gap against government and diplomatic targets, and the underlying certificate only recently expired—without mandatory blocklisting—any organization that has not manually activated the patch remains exposed to firmware-persistent, kernel-level implants that survive OS reinstallation.
Attack Path Analysis
APT41-linked actors targeted diplomatic organizations in Central Asia by first gaining initial network access through unspecified means, then escalating to administrator privileges to deploy the BlackX UEFI bootkit exploiting the unactivated Baton Drop patch (CVE-2022-21894). The bootkit injected a malicious kernel driver that disabled security callbacks and ETW providers, enabling persistent lateral movement across host systems. C2 communications were conducted covertly through legitimate cloud storage services (Google Drive, OneDrive, Yandex.Disk) and a custom Rust payload communicating with archivetj[.]com, while a RAT facilitated file upload and download operations for espionage exfiltration. The ultimate impact was sustained, stealthy cyberespionage against diplomatic targets with deep firmware-level persistence that survived OS reinstalls.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
APT41 actors gained initial access to the networks of diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan through unspecified initial access vectors. The delivery of the BlackX installer package (inst.exe and RC4-encrypted PVMDIJGKAX2) to C:\ProgramData\Intel\ suggests prior access via spearphishing, valid credentials, or exploitation of an internet-facing service. The installer's design to avoid malicious strings and embed payloads in an encrypted external file reflects deliberate operational security to evade endpoint detection at initial delivery.
Related CVEs
CVE-2022-21894
CVSS 4.4A Secure Boot Security Feature Bypass vulnerability in Windows Boot Manager allows an attacker with physical access or admin privileges to bypass Secure Boot and load unsigned UEFI code, enabling persistent bootkit installation via custom Machine Owner Keys (MOK). This vulnerability, known as Baton Drop, was exploited by the BlackLotus and BlackX bootkits.
Affected Products:
Microsoft Windows 10 – 1507, 1607, 1809, 20H2, 21H1, 21H2, 22H2
Microsoft Windows 11 – 21H2, 22H2
Microsoft Windows Server – 2012, 2012 R2, 2016, 2019, 2022
Exploit Status:
exploited in the wildCVE-2023-24932
CVSS 6.7A Secure Boot Security Feature Bypass vulnerability in Windows Boot Manager that allows an attacker with physical access or administrator privileges to install a malicious boot policy and bypass Secure Boot protections. Referenced in ESET reporting on APT41-linked FishMonger activity potentially involving UEFI bootkit components.
Affected Products:
Microsoft Windows 10 – 1507, 1607, 1809, 20H2, 21H2, 22H2, 23H2
Microsoft Windows 11 – 21H2, 22H2, 23H2
Microsoft Windows Server – 2012, 2012 R2, 2016, 2019, 2022, 2023
Exploit Status:
exploited in the wildReferences:
https://nvd.nist.gov/vuln/detail/CVE-2023-24932https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d
MITRE ATT&CK® Techniques
Pre-OS Boot: Bootkit
Exploitation for Defense Evasion
Rootkit
Hijack Execution Flow: DLL Side-Loading
Impair Defenses: Disable or Modify Tools
Web Service: Bidirectional Communication
Obfuscated Files or Information: Software Packing
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
CISA Zero Trust Maturity Model 2.0 – Continuous Device Integrity Monitoring
Control ID: Device Pillar – Device Visibility and Analytics
NIS2 Directive – Supply Chain and Software Integrity
Control ID: Article 21(2)(e)
DORA (EU 2022/2554) – ICT Vulnerability and Patch Management
Control ID: Article 9 – ICT Security Policies and Tools
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities
Control ID: A.8.8
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: Section 500.05
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
APT41's BlackX UEFI bootkit directly targeted Central Asian diplomatic agencies, exploiting CVE-2022-21894 to bypass Secure Boot, exfiltrate data via cloud C2, and evade lateral movement detection controls mapped to NIST.800-53.SC-7.
International Affairs
Diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan face persistent APT espionage implant risks, with RAT payloads using Google Drive and OneDrive for C2, undermining egress security and encrypted traffic compliance under ZTMM.Data.
Information Technology/IT
UEFI-level kernel implants disabling security callbacks and ETW providers expose IT infrastructure to privilege escalation and undetected lateral movement, directly challenging zero trust segmentation and multicloud visibility controls per NIST.800-53.AC-6.
Defense/Space
APT41-attributed bootkit campaigns targeting sovereign state infrastructure signal high risk for defense sectors, where unactivated Baton Drop patches leave UEFI firmware vulnerable to espionage implants bypassing inline IPS and egress policy enforcement.
Sources
- How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asiahttps://securelist.com/uefi-bootkit-blackx/121539/Verified
- CVE-2022-21894 - Secure Boot Security Feature Bypass Vulnerability (NVD)https://nvd.nist.gov/vuln/detail/CVE-2022-21894Verified
- CVE-2023-24932 - Secure Boot Security Feature Bypass Vulnerability (NVD)https://nvd.nist.gov/vuln/detail/CVE-2023-24932Verified
- BlackLotus UEFI bootkit: Myth confirmed (ESET WeLiveSecurity)https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/Verified
- KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832dVerified
- Microsoft Security Response Center - CVE-2022-21894 Advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21894Verified
- APT41 Group - MITRE ATT&CKhttps://attack.mitre.org/groups/G0096/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this APT41 campaign because the attackers relied on unrestricted east-west movement, uncontrolled egress to cloud storage platforms, and absence of workload-level segmentation to sustain long-term espionage access. By enforcing identity-aware segmentation and egress policy controls at the network fabric level, CNSF would likely reduce the attacker's reachability across diplomatic network segments and constrain covert exfiltration paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Fabric-level visibility into inbound connections and workload access patterns would likely reduce the attacker's ability to quietly establish a foothold without triggering anomalous traffic signals across the environment.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what a privilege-escalated workload can access across the network, even when host-based security controls have been actively disabled by a kernel-level implant.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to freely traverse between workloads and network segments, narrowing the paths available for lateral staging and tool deployment across the diplomatic infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and egress control over outbound destinations could reduce the attacker's ability to freely use legitimate cloud storage platforms and uncategorized external domains as unmonitored C2 channels.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement with FQDN-aware filtering would likely reduce the attacker's ability to exfiltrate diplomatic files over cloud storage platforms that fall outside approved outbound destinations for the affected workloads.
While UEFI-level persistence and kernel-level security tool disruption remain host-resident risks outside network fabric control, the blast radius of affected diplomatic workloads would likely be reduced — meaning the attacker's ability to freely pivot, exfiltrate, and maintain broad access across the broader network would be meaningfully constrained even if individual endpoints remained compromised.
Impact at a Glance
Affected Business Functions
- Diplomatic Communications and Classified Correspondence
- Government Information Systems and Secure Data Repositories
- Foreign Policy and Inter-Ministerial Coordination Platforms
- Endpoint Security and IT Infrastructure Integrity
Estimated downtime: 21 days
Estimated loss: N/A
Long-term covert access to diplomatic communications, classified government correspondence, foreign policy documents, personnel records of diplomatic staff, and inter-agency coordination data across government agencies in Tajikistan, Uzbekistan, and Turkmenistan. The persistent UEFI bootkit implant allowed kernel-level surveillance and exfiltration of sensitive materials over an extended period, with the RAT payloads using Google Drive, OneDrive, and Yandex.Disk for stealthy C2 data exfiltration. The scope of data exposure is assessed as high-value state-level intelligence with potential geopolitical implications.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement with FQDN filtering to block C2 communications to both known-malicious domains (archivetj[.]com) and to restrict unauthorized outbound access to cloud storage platforms (Google Drive, OneDrive, Yandex.Disk) used as covert C2 channels — preventing exfiltration over legitimate SaaS without explicit policy approval.
- • Implement Zero Trust Segmentation and East-West Traffic Security across diplomatic network environments to enforce least-privilege workload-to-workload communication policies, limiting the blast radius of kernel-level compromise and preventing lateral movement from an initial beachhead to other sensitive hosts.
- • Enable Multicloud Visibility & Control with centralized traffic observability to detect anomalous outbound connections to cloud storage APIs and unusual internal traffic patterns indicative of DLL sideloading or privilege abuse — providing the behavioral baselining needed to surface APT41-style living-off-the-land techniques.
- • Apply Cloud Firewall (ACF) and Inline IPS (Suricata) controls at network egress points to enforce URL and FQDN filtering that blocks access to unrecognized cloud storage endpoints used for C2, while inline signature-based inspection can detect known malicious payload delivery patterns and exploit traffic associated with CVE-2022-21894 exploitation attempts.
- • Enforce Encrypted Traffic (HPE) inspection policies on all east-west and egress flows to ensure that data exfiltrated via encrypted HTTPS channels to cloud storage is subject to policy-enforced inspection or blocking — closing the visibility gap that allows legitimate-looking encrypted exfiltration traffic to evade detection without inline enforcement.
