# A New Bootkit Targeting Diplomatic Networks in Central Asia: What We Know
## Introduction
A newly identified cybersecurity threat has emerged that specifically targets diplomatic organizations across Central Asia. The attack involves a highly advanced piece of malicious software known as a bootkit, which operates at a level deeper than most traditional malware — embedded directly into a computer’s firmware before the operating system even loads.
Security researchers have traced this campaign back to a state-sponsored group with ties to China, which has been observed carrying out espionage operations against government entities in several countries. The campaign appears to have ramped up in early 2026 and continues to evolve.
## Understanding the Bootkit: What It Does and How It Works
A bootkit is a particularly dangerous type of malware because it infects the firmware that controls how a computer starts up. By embedding itself at this early stage, the bootkit can bypass most security defenses that normally activate once Windows begins loading.
This particular bootkit exploits a known vulnerability in Microsoft’s Secure Boot feature, a security mechanism designed to ensure that only trusted software runs during the boot process. The flaw, once widely reported, was patched by Microsoft, but the patch requires several manual follow-up steps to fully take effect — steps that many organizations have overlooked.
The attackers have taken advantage of this gap. Even on systems that received the official patch, the vulnerability can still be exploited if the additional manual security measures are not completed. The certificate associated with the patch eventually expired, but simply letting it expire does not block the vulnerable components unless they are explicitly blocklisted by the system administrator.
## The Attack Chain
The attack follows a multi-stage process once the hackers gain initial access to a target network:
**First**, the attackers deploy an installer file along with an encrypted data package to the compromised system. The installer is executed through the command line using a specific decryption key.
**Next**, the bootkit drops additional files onto both the main system partition and the UEFI firmware partition. These files exploit the Secure Boot vulnerability to inject a malicious driver directly into the Windows kernel.
**Then**, the malicious driver attempts to weaken or disable endpoint security software on the machine. Interestingly, some of the interference routines were programmed to only activate if certain security products were detected, though researchers found these routines to be largely ineffective.
**Finally**, the bootkit installs a user-level spying tool designed to harvest system data and upload sensitive files. Two distinct payloads have been identified — one that uses cloud storage services like Google Drive and OneDrive as a hidden communication channel, and another that disguises itself as a legitimate Google update file to run unauthorized code.
## Who Is Behind the Attacks
The campaign has been linked to a China-based hacking group that has been active for several years. This group is known for targeting government agencies, diplomatic missions, and technology organizations across Asia and beyond.
What makes this particular campaign notable is that the attackers adapted a tool originally developed by cybercriminals and repurposed it for state-sponsored espionage. This kind of approach — borrowing or copying techniques from the underground hacking economy — is relatively rare among state-aligned groups.
Researchers identified several technical signatures connecting the group to previous operations, including the reuse of specific code strings and a preference for a technique called DLL sideloading, which is a hallmark of Chinese-linked threat actors.
## Protecting Against This Threat
Organizations can take several steps to reduce their risk:
– Ensure all firmware and operating system updates are installed promptly
– Manually apply all Secure Boot mitigation steps recommended by Microsoft, including adding specific certificates to the system’s blocklist
– Monitor UEFI partitions for unauthorized changes
– Use endpoint detection tools that can identify suspicious kernel-level activity
– Conduct regular security audits focused on firmware integrity
—
## Frequently Asked Questions (FAQ)
**What is a bootkit?**
A bootkit is a type of malware that infects the firmware or bootloader of a computer, allowing it to execute malicious code before the operating system and its security features are loaded. This makes it extremely difficult to detect and remove.
**Why is this threat particularly dangerous?**
Because it operates at the firmware level, the bootkit can bypass nearly all software-based security defenses. It persists even if the operating system is reinstalled, unless the firmware itself is reflashed or the affected partitions are cleaned.
**Which organizations are being targeted?**
Diplomatic entities in Central Asian countries, including Tajikistan, Uzbekistan, and Turkmenistan, have been the primary targets. The attackers appear to be focused on espionage rather than financial gain.
**Can standard antivirus software detect this threat?**
Standard antivirus tools may not detect firmware-level bootkits because the malware operates below the operating system’s visibility. Specialized firmware integrity checking tools and manual UEFI partition reviews are recommended for detection.
**Is my personal computer at risk?**
At this time, the attacks appear to be targeted at specific diplomatic and government organizations. The level of access required — administrator privileges or physical access to the machine — makes widespread attacks on personal computers unlikely, though not impossible.
**What should organizations do if they suspect infection?**
Organizations should engage professional cybersecurity responders who can inspect UEFI firmware, validate Secure Boot configurations, and scan for unauthorized drivers and payloads in the kernel.
—
## Conclusion
The emergence of this new bootkit highlights an ongoing and growing trend: advanced threat actors increasingly targeting the foundational layers of computer systems to maintain persistent, hard-to-detect access. For diplomatic and government organizations, the stakes are especially high, as the compromised data can have far-reaching geopolitical consequences.
The campaign also serves as a reminder that simply installing a software patch is not always enough. Organizations must follow through with every recommended manual step to fully close a security gap. Vigilance, regular firmware audits, and a layered security approach remain essential defenses against these deeply embedded threats.
Thank you for reading
