BlackX Bootkit Exploits Baton Drop Flaw to Evade Secure Boot

CVE-2022-21894 — the Baton Drop vulnerability — has been reused in a new UEFI bootkit, BlackX, to bypass Secure Boot and install a kernel driver that sabotages endpoint defenses, Kaspersky researchers report.

BlackX targets diplomatic agencies in Central Asia

Kaspersky says BlackX was discovered in early 2026 and observed in an espionage campaign focused on diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. The operation has been attributed with medium confidence to APT41 (also tracked as Brass Typhoon, Wicked Panda, and Barium), according to the same analysis.

Reuse of Baton Drop and striking similarity to BlackLotus

Kaspersky’s analysis links BlackX to the Baton Drop vulnerability (CVE-2022-21894). The researchers found BlackX’s implementation “remarkably similar” to BlackLotus, a BlackX predecessor that circulated on hacker forums beginning in October 2022 and which ESET confirmed in March 2023 as exploiting Baton Drop to bypass Secure Boot — at that time even on fully patched Windows 11 systems.

BlackX allows attackers to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files, providing the same bypass of Secure Boot protections that BlackLotus used. Kaspersky’s report notes two possible origins for BlackX’s code: reverse-engineering of BlackLotus or acquisition of BlackLotus source code. Although BlackLotus source code was leaked in July 2023, that leak was incomplete; Kaspersky found code in BlackX samples that was absent from the public repository, leading researchers to conclude the operator either reverse-engineered BlackLotus or purchased its source code.

Signed kernel driver and evasive sabotage of security products

Once Secure Boot is bypassed, BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio. Kaspersky reports the driver disables security-related processes and registry callbacks and tampers with Event Tracing for Windows (ETW) providers to frustrate monitoring.

The researchers further note that some tampering routines are configured to run only if Kaspersky or Avast products are detected on the host, and they add that the mechanism is “useless against the company's solutions.” The driver also intercepts user requests to open the bootkit’s files and returns a benign program — launching the Windows Calculator — as a cover.

Espionage payloads: cloud-based RAT and OxiDLLRunner

Kaspersky describes multiple follow-on payloads deployed by BlackX. One is a remote-access trojan (RAT) that uses cloud services — Google Drive, OneDrive, or Yandex.Disk — for command-and-control (C2), allowing execution of .NET payloads and file upload/download. Another is OxiDLLRunner: an OLLVM-obfuscated DLL sideloaded by googleupdate.exe that decrypts a v8_context_snapshot.bin file to launch shellcode and a Rust payload. That Rust component retrieves DLL plugins from archivetj[.]com and executes their create_plugin functions in separate threads.

Patch gap: manual revocation and certificate expiration do not close the hole

Kaspersky emphasizes that all BlackX victims were running fully patched Windows releases, yet the bootkit succeeded because administrators had not manually activated additional Secure Boot revocations. The patch for the Baton Drop vulnerability is designed to revoke the “Windows Production PCA 2011” certificate used to sign vulnerable UEFI components, but that revocation does not occur automatically upon patch installation — “the user has to trigger it manually,” Kaspersky explains.

The researchers call this a gap in the update process, noting it is “extremely uncommon for administrators to take any manual action after applying a security update.” They say attackers appear to have exploited this mitigation gap when creating BlackX. Kaspersky also warns that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not prevent vulnerable binaries from loading on Windows systems unless administrators proactively add the certificate to a blocklist.

What this means for technologists, diplomats, and antivirus vendors

• Technologists and security teams: An applied patch alone may not be sufficient; administrators must trigger the specific revocation for “Windows Production PCA 2011” to prevent Baton Drop-style bypasses.
• Diplomatic and government IT managers in affected countries: Systems in Tajikistan, Uzbekistan, and Turkmenistan were targeted — organizations in similarly sensitive roles should verify manual revocation steps and check for indicators consistent with EFI-level compromises.
• Antivirus and endpoint vendors: Kaspersky’s findings highlight attackers’ willingness to tailor kernel drivers and payloads that conditionally disable defenses when certain products are present, and to use signed drivers even when certificates are revoked.

Kaspersky’s reporting underscores a tension between shipped patches and necessary post-update actions: a mitigation that requires manual follow-up can become the very lever attackers exploit. As Kaspersky notes, the attacker invested time reproducing BlackLotus behavior and adapting it into BlackX, then paired the boot-level bypass with signed kernel drivers and cloud-based C2 to establish resilient espionage footholds. The immediate, concrete step the report highlights is administrative: trigger the certificate revocation and add the certificate to a blocklist where required.

Read the original Kaspersky analysis and BleepingComputer reporting here: https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/