Cybersecurity
BlackX bootkit exploits Baton Drop to evade Secure Boot
Researchers said BlackX, a UEFI bootkit used in an early 2026 espionage campaign, relied on the Baton Drop flaw to get past Secure Boot and load a driver aimed at security tools.
- Kaspersky said BlackX was used in an espionage campaign that began in early 2026 and that the operation was attributed with medium confidence to APT41.
- The campaign targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan.
- Kaspersky said BlackX used Baton Drop to load EFI files and enrol custom Machine Owner Keys, while ESET had earlier confirmed BlackLotus used the same flaw.
- Kaspersky said the bootkit still worked on fully patched Windows releases because administrators had not manually applied the Secure Boot revocation linked to the Windows Production PCA 2011 certificate.
Kaspersky researchers said BlackX was a UEFI bootkit used in an espionage operation identified in early 2026. They said the activity was linked with medium confidence to APT41 and focused on diplomatic bodies in Central Asia.
The researchers said BlackX resembled BlackLotus in the way it used Baton Drop, or CVE-2022-21894, to defeat Secure Boot. They said the approach let the attacker add custom Machine Owner Keys and run EFI files, while the bootkit used a different kernel driver and later-stage payloads.
Kaspersky said the malicious driver was signed with a certificate that had been issued to Wenjiang District Mingyu Network Technology Service Studio and was later revoked. The driver disabled security-related processes and registry callbacks, altered Event Tracing for Windows components, and used cloud services such as Google Drive, OneDrive and Yandex.Disk for command and control.
The researchers said the infections succeeded on fully patched Windows systems because the relevant Secure Boot revocation had not been applied manually. They said the update process left a gap, since administrators rarely take extra action after installing a security update.
Named in this story
Companies
- Kaspersky
- analysed the bootkit and published the findings
- ESET
- previously confirmed that BlackLotus used Baton Drop
- Wenjiang District Mingyu Network Technology Service Studio
- organisation named on the driver certificate
- Kaspersky and Avast
- security vendors whose products were targeted by the driver
Organisations
- APT41
- attributed operator of the campaign
Products and systems
- BlackX
- UEFI bootkit analysed in the report
- BlackLotus
- earlier bootkit used for comparison
- Baton Drop
- vulnerability used to defeat Secure Boot
- CVE-2022-21894
- identifier for the Baton Drop vulnerability
- Windows Production PCA 2011 certificate
- certificate that had to be revoked for the fix
- Google Drive
- one cloud service used for command and control
- OneDrive
- one cloud service used for command and control
- Yandex.Disk
- one cloud service used for command and control
- OxiDLLRunner
- obfuscated DLL sideloaded during infection
- googleupdate.exe
- process used to sideload OxiDLLRunner
Places
- Tajikistan
- one of the countries targeted in the campaign
- Uzbekistan
- one of the countries targeted in the campaign
- Turkmenistan
- one of the countries targeted in the campaign
How the source tells it
The piece was a technical threat report in a restrained register, with no distinct emotive framing beyond a brief caution about the patching gap.
No emotive framing was found in the original.