BlackX UEFI Bootkit Exploits Baton Drop Vulnerability to Bypass Secure Boot

A new UEFI bootkit named BlackX has been deployed in an espionage campaign attributed to the Chinese state-sponsored threat group APT41. Discovered in early 2026, BlackX exploits the Baton Drop vulnerability to bypass Secure Boot protections and load a malicious driver aimed at disrupting security solutions from Kaspersky and Avast.

The operation has targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan. Kaspersky researchers noted that BlackX shares similarities with the previously known BlackLotus bootkit, which has been circulating on hacker forums since October 2022 and also exploited the Baton Drop vulnerability (CVE-2022-21894).

In March 2023, ESET confirmed that BlackLotus could compromise even fully patched Windows 11 systems by exploiting the same vulnerability. Kaspersky’s analysis revealed that BlackX’s implementation of the exploit is “remarkably similar” to that of BlackLotus, enabling attackers to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files.

However, BlackX differs by deploying a distinct kernel driver and follow-on payloads. Kaspersky suggests that BlackX may have been developed through reverse-engineering BlackLotus or by acquiring its source code.

Despite the source code for BlackLotus being leaked in July 2023, Kaspersky found that some analyzed samples contained code not present in the public repository, indicating that the BlackX operator could not have obtained it from the leaked materials. This leads researchers to believe the attacker either reverse-engineered BlackLotus or purchased its source code.

BlackX Capabilities

BlackX injects a malicious Windows kernel driver that is signed with a now-revoked certificate from an organization named Wenjiang District Mingyu Network Technology Service Studio. This driver disables security-related processes and registry callbacks, obstructing monitoring by tampering with Event Tracing for Windows (ETW) providers.

Notably, some tampering procedures are configured to activate only when Kaspersky or Avast products are detected on the target host. The driver also protects the bootkit’s files by intercepting user requests to access them, launching the Windows Calculator instead.

BlackX is designed to deploy several espionage payloads on infected machines, including:

• A Remote Access Trojan (RAT) that utilizes Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and manage file uploads and downloads.
• OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by googleupdate.exe, which decrypts v8_context_snapshot.bin to launch shellcode and a Rust payload that retrieves DLL plugins from archivetj[.]com and executes their ‘create_plugin’ functions in separate threads.

Insufficient Fix

Kaspersky reports that all identified BlackX victims were using fully patched Windows releases. Despite this, the bootkit was successful because administrators did not manually activate the additional Secure Boot revocations required after patch installation.

Kaspersky explains, “The patch for the Baton Drop vulnerability is designed to revoke the ‘Windows Production PCA 2011’ certificate used to sign vulnerable UEFI components. However, this revocation does not happen automatically upon patch installation – the user has to trigger it manually.”

This gap in the update process is concerning, as it is uncommon for administrators to take manual action after applying security updates. Researchers believe that the attacker exploited this mitigation gap to understand BlackLotus and create a copycat bootkit.

Instructions for fully patching the Baton Drop vulnerability (CVE-2022-21894) are available from Microsoft. Kaspersky warns that the expiration date of the “Windows Production PCA 2011” certificate on October 19, 2026, does not prevent vulnerable binaries from loading on Windows systems unless administrators actively add the certificate to a blocklist.

Source: BleepingComputer