BlackX UEFI Bootkit Exploits Baton Drop Vulnerability in Espionage Campaign
A new UEFI bootkit known as BlackX has emerged as a critical threat in an espionage campaign that began in early 2026. This bootkit exploits the Baton Drop vulnerability to bypass Secure Boot protections, allowing it to load malicious drivers that interfere with security solutions from Kaspersky and Avast. The operation has been attributed to APT41, a Chinese state-sponsored threat group also referred to as Brass Typhoon, Wicked Panda, and Barium.
Discovered in early 2026, BlackX primarily targeted diplomatic agencies in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. Researchers from Kaspersky analyzed the bootkit and noted its similarities to BlackLotus, which has been circulating on hacker forums since October 2022. Both bootkits leverage the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protections.
ESET confirmed in March 2023 that BlackLotus exploited the Baton Drop vulnerability, successfully compromising even fully patched Windows 11 systems. Kaspersky researchers observed that BlackX's implementation of the exploit is remarkably similar to that of BlackLotus, enabling attackers to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections. However, BlackX differentiates itself by deploying a different kernel driver and follow-on payloads.
Kaspersky suggests that BlackX may have been derived from reverse-engineering BlackLotus or from its source code. Although the source code for BlackLotus was leaked in July 2023, Kaspersky found that some samples contained code not present in the public repository, indicating that the BlackX operator could not have obtained this code from the leaked materials. This leads researchers to believe that the attacker either reverse-engineered BlackLotus or purchased its source code.
Mechanisms of BlackX Bootkit Functionality
The BlackX bootkit injects a malicious Windows kernel driver signed with a now-revoked certificate issued to Wenjiang District Mingyu Network Technology Service Studio. This driver disables security-related processes and registry callbacks, obstructing monitoring by tampering with Event Tracing for Windows (ETW) providers. Notably, some tampering procedures are configured to activate only if Kaspersky or Avast products are detected on the target system, although this mechanism is ineffective against the companies' solutions.
Additionally, the driver protects the bootkit's files by intercepting user requests to open them, instead launching the Windows Calculator. The primary goal of BlackX is to deploy espionage payloads on infected machines. Kaspersky reports that all victims of BlackX were using fully patched Windows releases, yet the bootkit was still successful due to administrators not manually activating the additional Secure Boot revocations.
Clearance Granted
The patch for the Baton Drop vulnerability is intended to revoke the "Windows Production PCA 2011" certificate used to sign vulnerable UEFI components. However, this revocation does not occur automatically upon patch installation; users must trigger it manually. Researchers highlight this gap in the update process, noting that it is uncommon for administrators to take manual action after applying a security update. They believe that the attacker capitalized on this oversight, investing time in understanding how BlackLotus operates to create a similar bootkit.
Instructions for fully patching the Baton Drop vulnerability (CVE-2022-21894) are available through various channels. Kaspersky warns that the expiration date of the "Windows Production PCA 2011" certificate on October 19, 2026, will not prevent vulnerable binaries from loading on Windows systems unless administrators add the certificate to a blocklist. Overall prevention scores can obscure what occurs after initial access; once attackers gain valid credentials, prevention effectiveness diminishes significantly.
