BlackX bootkit abuses old Baton Drop flaw to bypass Secure Boot

A newly identified UEFI bootkit called BlackX has been used in an espionage campaign to bypass Secure Boot and load malware before Windows starts. Researchers linked the activity to attacks against diplomatic organisations in Central Asia, with victims reported in Tajikistan, Uzbekistan and Turkmenistan.¹

BlackX abuses Baton Drop, the name commonly used for CVE-2022-21894, a vulnerability that can let attackers use vulnerable Windows boot components to get around Secure Boot protections. Kaspersky researchers found that the bootkit can enrol custom Machine Owner Keys and load arbitrary EFI files, giving an attacker control at a stage where ordinary Windows security tools have limited visibility.²

What BlackX does

The campaign was discovered in early 2026 and is technically related to BlackLotus, the UEFI bootkit that drew attention after it was found bypassing Secure Boot. Kaspersky says BlackX’s exploitation code is remarkably similar to BlackLotus, but its kernel driver and later payloads are different. The researchers believe the operators either reverse-engineered BlackLotus or obtained parts of its source code.²

Once installed, BlackX deploys a kernel driver signed with a revoked certificate. The driver attempts to interfere with security software by disabling process, thread and registry callbacks, and by tampering with Event Tracing for Windows providers. Some of those routines specifically check for Kaspersky or Avast products, although Kaspersky’s analysis found that the attempted interference did not work against its own software.²

The bootkit also protects its files by intercepting requests to open them and returning a handle to the Windows Calculator instead. That unusual trick is less important than the underlying access: the malware is operating below the normal application layer, giving defenders another stage to investigate during incident response.

The patching gap

The most important detail is that BlackX succeeded against fully patched Windows installations, according to Kaspersky. Installing the security update for Baton Drop is not necessarily enough. The vulnerable Windows Production PCA 2011 certificate must also be revoked through the relevant Secure Boot protections, and that additional action may need to be activated by an administrator.¹²

Microsoft’s guidance explains how administrators can revoke vulnerable Windows boot managers and update the relevant Secure Boot databases.³ Organisations handling sensitive systems should treat the certificate and boot-manager state as a separate verification task rather than assuming that a normal Windows Update run completed every mitigation step.

BlackX then delivers espionage tools, including a remote-access Trojan that uses cloud storage services such as Google Drive, OneDrive or Yandex.Disk for command and control. Another payload, called OxiDLLRunner, uses DLL sideloading and a Rust component to retrieve and execute further plugins.¹²

Kaspersky attributed the campaign to APT41 with medium confidence. That assessment is based on similarities in the payloads, development patterns and links to earlier activity, rather than a definitive public identification of the operators.¹²

Our opinion

BlackX is a reminder that “fully patched” is not the same as “fully mitigated” when the boot chain is involved. Secure Boot is only useful if vulnerable certificates and boot components are actually blocked. The practical lesson is straightforward: administrators should verify revocation databases and boot-manager protections on sensitive Windows systems, not just the date of the last update. That extra check is less dramatic than a new bootkit name, but it is the part most likely to prevent this old weakness from becoming a fresh compromise.