Cybersecurity

BlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Boot

Discovered in early 2026, the BlackX UEFI bootkit targets diplomatic agencies in Central Asia while leveraging an older vulnerability to bypass Secure Boot defenses on fully patched systems.

Radwan AbdulhadiEditor and technology writer

Published: October 24, 2026 · Updated: October 24, 2026 · 3 min read

BlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Boot — Image: BleepingComputer

Overview of the BlackX UEFI Bootkit

A new UEFI bootkit named BlackX was deployed in an espionage campaign in early 2026, exploiting the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.

According to reporting by Bill Toulas, the operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium.

The malicious activity was discovered in early 2026 and specifically targeted diplomatic agencies in Central Asia, with notable activity observed in Tajikistan, Uzbekistan, and Turkmenistan.

Exploitation of the Baton Drop Vulnerability

Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.

As ESET confirmed in March 2023, BlackLotus exploited Baton Drop and at the time could compromise even fully patched Windows 11 systems.

As noted by Kaspersky explains, BlackX's implementation of the exploit is remarkably similar to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.

Although source code for BlackLotus was leaked in July 2023, the release was incomplete, leading researchers to believe that BlackX creators either reverse-engineered the framework or obtained the source code independently.

Driver Capabilities and Espionage Payloads

BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and registry callbacks while tampering with Event Tracing for Windows (ETW) providers to obstruct system monitoring.

The researchers note that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host. Additionally, the driver protects bootkit files by intercepting user requests to open them and launching the Windows Calculator instead.

Beyond interfering with security solutions, the driver's purpose includes deploying espionage payloads on infected machines, such as a RAT leveraging Google Drive, OneDrive, or Yandex.Disk for command-and-control operations.

Mitigation Gaps and Remediation Guidance

Kaspersky observed that all BlackX victims used a fully patched Windows release, but the bootkit succeeded because administrators did not manually activate additional Secure Boot revocations. Detailed instructions to fully patch Baton Drop (CVE-2022-21894) are available here.

Researchers warn that standard patch installation does not automatically trigger the necessary certificate revocations, leaving an update gap that advanced threat actors actively exploit.