Kaspersky: APT41 hit Central Asian diplomats with BlackX bootkit via Baton Drop

Kaspersky GReAT attributed a campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan to APT41. The new BlackX UEFI bootkit exploits CVE-2022-21894 (Baton Drop) even though Microsoft's patches were installed on all targeted machines but never fully activated.

• BlackX is an evolved version of the criminal BlackLotus bootkit sold for $5,000
• It exploits CVE-2022-21894 despite Microsoft's 2023 patches
• Its kernel driver was signed with a Chinese business certificate, since revoked
• The bootkit survives OS reinstall and disk replacement, evading antivirus