A newly identified UEFI bootkit called BlackX was used in an espionage campaign in early 2026 to get around Secure Boot protections by exploiting the old Baton Drop vulnerability, then load a malicious driver built to interfere with security products from Kaspersky and Avast. Kaspersky researchers attributed the operation to APT41, a Chinese state-sponsored threat group also tracked as Brass Typhoon, Wicked Panda, and Barium, with medium confidence. The campaign targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.
Kaspersky's analysis of BlackX found close similarities to BlackLotus, a bootkit that has circulated on hacker forums since October 2022 and used Baton Drop (CVE-2022-21894) to bypass Secure Boot. ESET confirmed in March 2023 that BlackLotus exploited the flaw and could at that time compromise even fully patched Windows 11 systems. According to Kaspersky, BlackX's exploit implementation is remarkably similar to BlackLotus's, letting the attacker enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to evade Secure Boot. BlackX differs from BlackLotus, however, in deploying a different kernel driver and follow-on payloads.
Kaspersky believes BlackX was either derived from reverse-engineering BlackLotus or built from its source code. The BlackLotus source code leaked in July 2023, but that release was incomplete, and Kaspersky found some BlackLotus samples containing code absent from the public repository yet present in BlackX. Because the BlackX operator could not have obtained that code from the leaked repository, the researchers concluded the attacker either reverse-engineered BlackLotus or purchased its source code.
BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and registry callbacks and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring. Some of that tampering is configured to run only when Kaspersky or Avast products are detected on the host, though the researchers said the mechanism is useless against Kaspersky's own solutions. The driver also intercepts user requests to open the bootkit's files and launches the Windows Calculator instead, and it deploys follow-on espionage payloads.
Kaspersky said all BlackX victims ran a fully patched Windows release, but the bootkit still succeeded because administrators did not manually activate the additional Secure Boot revocations. The company explained that the Baton Drop patch is designed to revoke the Windows Production PCA 2011 certificate used to sign vulnerable UEFI components, but that revocation does not happen automatically when the patch is installed and must be triggered by the user. The researchers described this as a gap in the update process, since administrators rarely take manual action after applying a security update, and said the attacker appeared to have exploited that mitigation gap by investing time in understanding BlackLotus and creating a copycat.
The researchers also warned that the October 19, 2026 expiration date of the Windows Production PCA 2011 certificate will not stop the vulnerable binaries from loading on Windows systems unless administrators add the certificate to a blocklist.
More cybersecurity news from TechManNews.
