New BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot in Central Asia espionage campaign

Kaspersky links the bootkit to Chinese state-sponsored group APT41, warns that many systems remain vulnerable despite available patch

By LineZotpaper AI staff

Published24 October 2026

Read Time3 min

A previously unknown UEFI bootkit dubbed BlackX has been used in an espionage campaign targeting diplomatic agencies in Central Asia, exploiting the old Baton Drop vulnerability to bypass Secure Boot protections, according to researchers at Kaspersky. The operation, detected in early 2026, has been attributed with medium confidence to the Chinese state-sponsored threat group APT41, also known as Brass Typhoon, Wicked Panda and Barium.

BlackX deploys a malicious Windows kernel driver signed with a now-revoked certificate issued to an organisation named Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring. Kaspersky researchers noted that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host.

The driver also protects the bootkit’s files by intercepting user requests to open them and launching the Windows Calculator instead. Its espionage payloads include a remote access trojan (RAT) that uses Google Drive, OneDrive or Yandex.Disk for command-and-control, and an obfuscated DLL sideloaded by googleupdate.exe that retrieves further plugins from a remote server.

Kaspersky found strong similarities between BlackX and the BlackLotus bootkit, which has been circulating on hacker forums since October 2022 and also leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot. BlackLotus was capable of compromising fully patched Windows 11 systems at the time ESET confirmed its exploitation in March 2023.

According to Kaspersky, BlackX's implementation of the Baton Drop exploit is "remarkably similar" to BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files. However, BlackX deploys a different kernel driver and follow-on payloads. The researchers suggested BlackX was either derived from reverse-engineering BlackLotus or from its source code, which was leaked incompletely in July 2023. Some BlackLotus samples analysed by Kaspersky contained code missing from the public repository but present in BlackX, leading researchers to believe the operator either reverse-engineered BlackLotus or purchased its source code.

Kaspersky said all BlackX victims used a fully patched Windows release, but the bootkit was successful because administrators did not manually activate the additional Secure Boot revocations required by the Baton Drop patch. “The patch for the Baton Drop vulnerability is designed to revoke the ‘Windows Production PCA 2011’ certificate used to sign vulnerable UEFI components,” Kaspersky explained. “However, this revocation does not happen automatically upon patch installation — the user has to trigger it manually.” The researchers called this a gap in the update process, noting it is extremely uncommon for administrators to take manual action after applying a security update.

Kaspersky said the attacker used this mitigation gap to their advantage and "decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit."

The researchers warned that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless administrators add the certificate to a blocklist.

Analysis

Why This Matters

The BlackX bootkit shows that threat actors continue to weaponise known vulnerabilities in the UEFI boot process, with Secure Boot bypasses remaining a viable attack vector years after patches are released.
The requirement for manual activation of certificate revocations means many fully patched Windows systems remain exposed, a systemic gap that affects all organisations relying on automatic updates.
The targeting of diplomatic agencies in Central Asia indicates a focused espionage campaign, but the techniques used have broad applicability to other sectors and regions.

Background

UEFI bootkits are among the most dangerous types of malware because they load before the operating system, making them extremely difficult to detect and remove once installed. The Baton Drop vulnerability (CVE-2022-21894) disclosed in early 2022 affects the Windows Secure Boot feature, allowing attackers to bypass protections even on fully patched systems if the additional revocation steps are not taken manually. BlackLotus, the first known bootkit to exploit this flaw in the wild, appeared on hacking forums in late 2022 and was subsequently used by criminal actors. Kaspersky has now identified a second bootkit, BlackX, that uses the same technique in a state-sponsored espionage context.

What to Watch

Whether Microsoft or other vendors change the update process to enforce certificate revocations automatically, removing the current manual step that leaves a window for exploitation.
Potential expansion of BlackX targets beyond Central Asian diplomatic agencies, or the emergence of further bootkits based on the same leaked or reverse-engineered code.
Any public attribution from law enforcement or other security firms that confirms or refines Kaspersky’s medium-confidence link to APT41.

Sources

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot · BleepingComputer

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedBlackX exploited Baton Drop to bypass Secure Boot in an espionage campaign targeting diplomatic agencies in Central Asia.BleepingComputer: “A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot”
SupportedKaspersky attributed the operation to APT41 with medium confidence.BleepingComputer: “The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group”
Partly supportedMany systems remain vulnerable despite the available patch.BleepingComputer: “The researchers warn that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist.”
SupportedThe campaign was detected in early 2026.BleepingComputer: “A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026”
SupportedKaspersky described BlackX’s Baton Drop implementation as “remarkably similar” to BlackLotus’s.BleepingComputer: “According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus”
Partly supportedKaspersky’s attribution of BlackX to APT41 is stated without a confidence level in the summary.BleepingComputer: “The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group”
SupportedThe driver disables security-related processes and registry callbacks, and tampers with ETW providers to obstruct monitoring.BleepingComputer: “The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to obstruct monitoring.”
SupportedSome tampering procedures run only if Kaspersky or Avast products are detected on the target host.BleepingComputer: “The researchers note that some tampering procedures are configured to run only if Kaspersky or Avast products are detected on the target host”
SupportedThe driver protects the bootkit’s files by intercepting requests to open them and launching Windows Calculator.BleepingComputer: “The driver also protects the bootkit’s files by intercepting user requests to open them and launching the Windows Calculator instead.”
SupportedKaspersky said BlackX victims were using fully patched Windows releases, but the bootkit succeeded because administrators had not manually activated additional Secure Boot revocations.BleepingComputer: “Kaspersky says that all BlackX victims used a fully patched Windows release. However, the bootkit was still successful because admins did not manually activate the additional Secure Boot revocations.”
SupportedKaspersky said revocation does not happen automatically when the patch is installed and must be triggered manually.BleepingComputer: ““However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually.””
SupportedThe “Windows Production PCA 2011” certificate’s October 19, 2026 expiration does not prevent vulnerable binaries from loading unless administrators add the certificate to a blocklist.BleepingComputer: “The researchers warn that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist.”