Central Asian Diplomatic Networks Hit by BlackX UEFI Bootkit Exploiting Secure Boot Gaps

A newly uncovered bootkit named BlackX has been shown to bypass Microsoft Secure Boot on Windows machines that have received recent patches but are missing critical revocation updates, security researchers say. The malicious code was observed targeting diplomatic institutions in Tajikistan, Uzbekistan and Turkmenistan during the first months of 2026, marking a focused campaign against foreign‑service infrastructure in the region.

UEFI bootkits operate at the firmware level, allowing attackers to gain control before the operating system loads. Secure Boot is designed to verify the integrity of boot components, while revocation lists enable the system to reject compromised binaries that have been identified after release. BlackX sidesteps these defenses by exploiting the lag between the discovery of a compromised component and the distribution of its revocation entry, effectively slipping through a security gap that many organizations assume is closed.

The campaign appears to have leveraged compromised firmware updates or supply‑chain intermediaries to deliver the payload, though the exact infection vector remains under investigation. Once installed, the bootkit can persist across operating‑system reinstalls and evade conventional antivirus tools, giving the attackers a stealthy foothold within high‑value diplomatic networks. The timing of the attacks, coinciding with heightened diplomatic activity in Central Asia, suggests a strategic motive to gather intelligence or disrupt communications.

Cyber‑security firms and national CERT teams have responded by issuing emergency advisories, urging affected entities to verify the presence of the latest revocation lists and to apply vendor‑provided firmware patches that incorporate additional integrity checks. Some analysts tentatively link the sophistication of BlackX to state‑backed actors, citing its ability to manipulate low‑level boot processes without triggering typical security alerts. However, definitive attribution is pending further forensic analysis.

The incident underscores the growing importance of firmware security in an era where traditional endpoint protections are no longer sufficient. Experts recommend that organizations adopt continuous monitoring of UEFI components, maintain up‑to‑date revocation databases, and consider employing hardware‑based root of trust solutions. As the investigation continues, diplomatic missions across the region are expected to tighten their cybersecurity posture, while vendors work to close the revocation lag that BlackX exploited.