A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.
The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium.
It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.
Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.
ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.
According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.
However, BlackX differs from BlackLotus and deploys a different kernel driver and follow-on payloads. Kaspersky suggests that BlackX was either derived from reverse-engineering BlackLotus or from its source code.
Although the source code for BlackLotus was leaked in July 2023, the release was incomplete. Kaspersky researchers found that some BlackLotus samples they analyzed contained code missing from the public repository but present in the BlackX bootkit.
Since the BlackX operator could not have obtained this code from the leaked repo, the researchers believe the attacker either reverse-engineered BlackLotus or purchased its source code.
BlackX capabilities
BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio.
The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring.
The researchers note that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host, adding that the mechanism is useless against the company's solutions.
The driver also protects the bootkit’s files by intercepting user requests to open them and launching the Windows Calculator instead.
Its purpose is also to deploy the following espionage payloads on infected machines:
- A RAT that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and upload and download files.
- OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by googleupdate.exe. It decrypts v8_context_snapshot.bin to launch shellcode and a Rust payload, which retrieves DLL plugins from archivetj[.]com and executes their ‘create_plugin’ functions in separate threads.
Insufficient fix
Kaspersky says that all BlackX victims used a fully patched Windows release. However, the bootkit was still successful because admins did not manually activate the additional Secure Boot revocations.
“The patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components,” Kaspersky explains.
“However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually.”
The researchers say this is a gap in the update process, since it’s extremely uncommon for administrators to take any manual action after applying a security update.
They believe that the attacker used this mitigation gap to their advantage and "decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."
Instructions to fully patch Baton Drop (CVE-2022-21894) are available here.
The researchers warn that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.