New BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot in Central Asia espionage campaign
Kaspersky links the bootkit to Chinese state-sponsored group APT41, warns that many systems remain vulnerable despite available patch
A previously unknown UEFI bootkit dubbed BlackX has been used in an espionage campaign targeting diplomatic agencies in Central Asia, exploiting the old Baton Drop vulnerability to bypass Secure Boot protections, according to researchers at Kaspersky. The operation, detected in early 2026, has been attributed with medium confidence to the Chinese state-sponsored threat group APT41, also known as Brass Typhoon, Wicked Panda and Barium.