A sophisticated cyber threat has emerged in Central Asia, targeting diplomatic organizations with a new Unified Extensible Firmware Interface (UEFI) bootkit known as BlackX. This attack has been linked to APT41, a state-sponsored hacking group believed to be associated with China, as detailed in Kaspersky’s recent technical report.
BlackX Bootkit: An Evolution of BlackLotus
BlackX, an evolution of the notorious BlackLotus bootkit first discovered in 2022, is designed to bypass Secure Boot protections on Windows systems. The original BlackLotus exploited a vulnerability identified as CVE-2022-21894, also known as Baton Drop, which required administrator privileges or physical access to be executed. This vulnerability, although patched, can still be exploited on systems that have not implemented specific manual security measures.
The BlackX bootkit maintains long-term access to targeted devices by evading Microsoft’s startup defenses and third-party security software. This persistence mechanism allows attackers to deploy additional malicious payloads, posing significant risks to compromised systems.
Exploitation and Deployment Tactics
Cyber attackers deploy BlackX after infiltrating victim networks and acquiring administrator rights. They use an installer executable, ‘inst.exe’, along with an encrypted file, to install the bootkit. This process involves exploiting the CVE-2022-21894 vulnerability, similar to BlackLotus, to load unauthorized EFI files during the boot process.
Interestingly, BlackX’s development suggests reverse engineering of BlackLotus or acquisition of its source code, as the original code has not been publicly available. This highlights a rare instance of advanced persistent threat (APT) actors adapting cybercrime tools for their operations.
Implications and Connections to APT41
BlackX’s operations reveal connections to APT41 through similarities with previous campaigns, such as the use of DLL sideloading and specific code patterns. The bootkit’s payloads include a malicious driver signed with a now-revoked certificate, aiming to disable endpoint security solutions and conduct cyber espionage.
Notably, these payloads include a remote access trojan and a malicious DLL, which facilitate further attacks and data exfiltration. These activities are part of a broader strategy to maintain covert control over high-value networks.
Concluding Observations
The emergence of BlackX underscores the ongoing challenge of securing boot processes against sophisticated threats. Organizations must implement comprehensive security measures, beyond basic updates, to mitigate such vulnerabilities. The adaptive approaches of groups like APT41 emphasize the need for vigilance and proactive defense to protect critical infrastructure in an evolving cyber landscape.
