A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security software, Kaspersky researchers have found.

Who was targeted

The operation targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan and Turkmenistan, and has been attributed with medium confidence to APT41, a Chinese state-sponsored group also known as Brass Typhoon, Wicked Panda and Barium. Medium confidence is not proof of state direction, and the attribution rests on code and technique overlaps rather than a confirmed link.

Kaspersky found BlackX's implementation of the exploit remarkably similar to BlackLotus, the bootkit that circulated on hacker forums from October 2022 and was confirmed by ESET in March 2023. Some BlackLotus code missing from the incomplete source code leaked in July 2023 appears in BlackX, suggesting the attacker either reverse-engineered BlackLotus or obtained its source another way.

Why patched systems were still at risk

BlackX exploits Baton Drop, tracked as CVE-2022-21894, to enrol custom Machine Owner Keys and load arbitrary EFI files before Windows starts. Crucially, it only works where an attacker already has administrator or physical access, and it succeeds on fully patched systems where Microsoft's manual Secure Boot revocation steps were never applied, including adding the Windows Production PCA 2011 certificate to the forbidden list.

Organisations that only install updates, without completing those manual revocations, remain exposed to this class of firmware-level persistence, which survives operating system reinstallation.

Sources: BleepingComputer, BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot; The Hacker News, BlackX UEFI bootkit bypasses Secure Boot on patched Windows systems missing revocations.