October 24, 2026 – A new UEFI bootkit called BlackX has turned up in a cyberespionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky researchers, who found it in early 2026 and published their analysis on October 22, say it exploits CVE-2022-21894, better known as “Baton Drop,” to get around Secure Boot. They attribute the campaign to APT41 with medium confidence.

The most worrying finding is that the compromised machines were fully patched. The fix for Baton Drop exists, but it doesn’t take effect on its own.

What Is BlackX?

BlackX closely resembles BlackLotus, the bootkit first advertised on a hacking forum in 2022 for $5,000 and confirmed by ESET in 2023. Kaspersky found that BlackX’s exploit implementation is strikingly similar to BlackLotus’s, though not identical.

The BlackLotus source code has never been published online. Kaspersky therefore believes the BlackX operators either reverse-engineered BlackLotus or bought its source from cybercriminals. Researchers rarely see state-linked actors borrow from criminal tools this way.

How the Attack Works

Attackers deploy BlackX only after they have already compromised a network and gained administrator rights. They drop an installer (inst.exe) and an RC4-encrypted file (PVMDIJGKAX2) that holds everything needed for installation. The installer contains no malicious code of its own, which makes the bootkit harder for incident responders to recover.

1. Secure Boot bypass. The installer places files on the system and EFI partitions and exploits Baton Drop to enroll attacker-controlled Machine Owner Keys (MOKs). That lets the machine load arbitrary EFI files at boot, before Windows starts.
2. Kernel driver. The bootkit injects a malicious driver into the Windows kernel, signed with a certificate that has since been revoked. The driver disables security-product callbacks and tampers with ETW providers. Some routines run only if Kaspersky or Avast products are installed, but Kaspersky found they had no effect on its own software.
3. File protection. When something tries to open the bootkit’s files, the driver returns a handle to the legitimate calc.exe instead.
4. Espionage payloads. The driver then deploys user-mode tools. Two were observed:

• A RAT that loads further .NET payloads and uses cloud storage (Google Drive, OneDrive and Yandex.Disk) for command and control.
• OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded through googleupdate.exe. It decrypts a Rust payload that contacts the C2 server at www[.]archivetj[.]com and receives plugin DLLs to run.

Why Fully Patched Systems Were Still Vulnerable

Microsoft’s fix for Baton Drop works by revoking the “Windows Production PCA 2011” certificate, which signed the vulnerable boot components. But installing the update doesn’t trigger that revocation. Administrators must do it manually by setting a registry flag under HKLM\SYSTEM\CurrentControlSet\Control\Secureboot and creating a scheduled task named Secure-Boot-Update.

Microsoft has a reason for not automating this: forcing the revocation could break dual-boot systems that rely on the old certificate. But it’s also unusual for administrators to take extra steps after installing an update, and the instructions are buried deep in Microsoft’s documentation. Kaspersky believes the attackers counted on this gap.

Microsoft’s rollout plan includes an “Enforcement Phase” that would revoke the certificate automatically. According to Kaspersky, it has not been implemented. The certificate expired on October 19, 2026, but expiry alone doesn’t stop the vulnerable binaries from loading unless the certificate is blocklisted.

Attribution

Kaspersky attributes the campaign to APT41 with medium confidence, based on three points:

• The identifier “xdd” appears in BlackX payloads and also in a kernel implant described in ESET’s June 2026 report on FishMonger, a group thought to be related to APT41. Kaspersky concludes BlackX is the UEFI component ESET referenced.
• The payloads load through a legitimate executable abused for DLL sideloading, paired with an encrypted file. This pattern is common among Chinese-speaking threat actors.
• OxiDLLRunner uses OLLVM obfuscation, also typical of those groups.

What Defenders Should Do

1. Activate the Baton Drop revocation. Follow Microsoft’s guidance on revoking vulnerable Windows boot managers: set the registry flag and confirm the Secure-Boot-Update task is in place. Test first on dual-boot or legacy-configured machines.
2. Verify boot integrity. Use security tooling that checks UEFI and boot-chain integrity.
3. Limit administrator rights. BlackX needs admin privileges to install, so least privilege shrinks the attack surface.
4. Hunt for sideloading and unusual traffic. Watch for suspicious child processes from legitimate binaries like googleupdate.exe, and for unexpected connections to cloud storage services or to archivetj[.]com.
5. Run exploit-prevention tooling. Kaspersky notes that endpoint products with exploit prevention can block exploitation even when a patch hasn’t been fully activated.

Sources:

https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/