Diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan have been targeted by the BlackX UEFI bootkit, suspected to be orchestrated by APT41, a China-linked hacking group.
The vulnerability or weakness
While the certificate expired on October 19, 2026, the vulnerability remains active if organizations do not manually apply mitigations.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2022-21894 | 4.4 | MEDIUM | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations risk long-term, covert access to their devices, undermining startup defenses and third-party security solutions, which can lead to data breaches and operational disruptions.
Industries affected
The incident primarily affects diplomatic entities in Central Asia.
Users affected
Users of affected systems face the risk of unauthorized access and potential data theft, impacting their security and trustworthiness.
