BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot - BleepingComputer
A new UEFI bootkit named BlackX, deployed in an early 2026 espionage campaign, exploited the Baton Drop vulnerability to bypass Secure Boot and interfere with security solutions from Kaspersky and Avast.
The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium. It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.
Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.
Exploit Implementation
According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.
BlackX Capabilities
BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring.
The researchers note that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host. The driver also protects the bootkit's files by intercepting user requests to open them and launching the Windows Calculator instead.
Mitigation Gap
Kaspersky says that all BlackX victims used a fully patched Windows release. However, the bootkit was still successful because admins did not manually activate the additional Secure Boot revocations. The researchers believe this is a gap in the update process, since it's extremely uncommon for administrators to take any manual action after applying a security update.
The researchers warn that the October 19, 2026 expiration date of the "Windows Production PCA 2011" certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist. Instructions to fully patch Baton Drop (CVE-2022-21894) are available for system administrators.
Related
