BlackX Bootkit Bypasses Secure Boot Using Baton Drop Vulnerability

A new UEFI bootkit called BlackX emerged in early 2026, deployed during an espionage operation targeting diplomatic agencies in Central Asia including Tajikistan, Uzbekistan, and Turkmenistan. The malware exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and install a kernel driver that disables security processes and interferes with Kaspersky and Avast protections. Researchers attribute the campaign with medium confidence to APT41, a Chinese state-sponsored threat group.

BlackX shares striking technical similarities with BlackLotus, an earlier bootkit circulating since October 2022. Both use the Baton Drop exploit to enroll custom Machine Owner Keys and load malicious EFI files. The kernel driver intercepts file access attempts, tampers with Windows Event Tracing, and disables security callbacks. The malware deploys remote access trojans using cloud services like Google Drive and OneDrive for command-and-control, alongside additional payloads including OxiDLLRunner, which retrieves plugins from external servers.

The bootkit succeeded against fully patched Windows systems because the Baton Drop patch requires administrators to manually activate Secure Boot revocations—a step rarely taken in practice. The patch revokes the “Windows Production PCA 2011” certificate, but this revocation requires manual triggering rather than occurring automatically. Researchers believe the attackers exploited this gap, reverse-engineering or obtaining source code from BlackLotus (whose code partially leaked in July 2023) to develop their own variant.