# How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

APT41 used the BlackX UEFI bootkit exploiting Baton Drop (CVE-2022-21894) to bypass Secure Boot and install a kernel driver on patched diplomatic machines in Central Asia.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft Windows
- Analysis by: Georgy Kucherin, Vladimir Nestor, Vasily Berdnikov
- Disclosed: 2026-10-22
- CVE: CVE-2022-21894
- Write-up quality: 8/10
- Original: https://securelist.com/uefi-bootkit-blackx/121539/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurelist-com-uefi-bootkit-blackx-121539
- Tags: area:os domain:desktop domain:infra impact:integrity impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:incomplete-fix technique:reverse-engineering vuln:auth-bypass vuln:misconfiguration vuln:privilege-escalation

**Target:** UEFI Secure Boot / Windows boot chain
**Root cause:** The Baton Drop patch only revokes the 'Windows Production PCA 2011' certificate when an administrator manually sets a registry flag and creates the Secure-Boot-Update scheduled task; without this, vulnerable signed UEFI components still load, letting the bootkit install custom MOKs.
**Steps:**
1. Gain admin privileges on victim network.
2. Drop `inst.exe` and RC4-encrypted `PVMDIJGKAX2` to `C:\ProgramData\Intel\`.
3. Run `C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1` (last arg is RC4 key).
4. Installer decrypts payload and drops files to system and UEFI partitions to exploit Baton Drop (CVE-2022-21894).
5. Exploit installs custom Machine Owner Keys (MOK) to load arbitrary EFI files and bypass Secure Boot.
6. UEFI payload injects a signed malicious kernel driver that disables security callbacks/ETW and protects bootkit files.
7. Driver deploys user-mode payloads: cloud-storage RAT (Google Drive/OneDrive/Yandex.Disk) and OxiDLLRunner DLL sideloaded via `googleupdate.exe`.
**How found:** Researchers noticed a BlackLotus-like sample in an APT campaign; investigating why fully patched machines were infected revealed the Baton Drop patch requires manual activation (registry flag plus Secure-Boot-Update scheduled task), which admins rarely perform.
**Exploitation:** After compromising networks and obtaining admin rights, attackers ran the installer with the RC4 key to drop Baton Drop exploit files to system and UEFI partitions, installing custom MOKs to load arbitrary EFI files despite Secure Boot. The bootkit injected a signed kernel driver (certificate since revoked) that disabled process/thread/registry callbacks and ETW for security products, then deployed espionage payloads: a cloud-storage C2 RAT and OxiDLLRunner, which decrypts `v8_context_snapshot.bin` to shellcode plus a Rust payload talking to `www[.]archivetj[.]com`.
**Escalation:** Bootkit-to-kernel-driver chain neutralizes security solutions, then pivots to user-mode RAT and DLL-sideloaded Rust payload for espionage.
**Insight:** A vendor patch that only stages a revocation and requires a manual registry flag plus scheduled task leaves fully patched hosts exploitable; check whether Secure Boot certificate revocation was actually activated, not just whether the update installed.

## Proof of concept (copied exactly from the original report)

**Installer command line with RC4 key**

```
The installer was launched with the command line C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1. The last argument here is the RC4 key used for decryption.
```

**RAT cloud storage file suffix task table**

```
File suffix
Description
Type

0X01
A .NET file. The task is to parse it and run the method TEST.Class1.RunCMD(argument_array) from the module
Input

0X02
Result of the call TEST.Class1.RunCMD(argument_array)
Output

0X03
Task to upload a file to the drive
Input

0X04
Uploaded file
Output

0X05
Task to download a file to an infected machine
Input

0X06
File download status
Output

SSSR
Contains initial system info
Output
```