BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A newly identified UEFI bootkit dubbed BlackX was deployed in an espionage campaign in early 2026, targeting diplomatic agencies across Central Asia by exploiting an older Secure Boot bypass flaw known as Baton Drop. Security researchers at Kaspersky analyzed the malware and attributed the operation with medium confidence to APT41, a Chinese state-sponsored threat group tracked under aliases including Brass Typhoon, Wicked Panda, and Barium. The intrusion campaign compromised victims located in Tajikistan, Uzbekistan, and Turkmenistan, relying on a bootkit architecture that shares striking technical similarities with the notorious BlackLotus malware first spotted circulating on hacker forums in October 2022. According to BleepingComputer's report, the threat actors leveraged the Baton Drop vulnerability, cataloged as CVE-2022-21894, to circumvent firmware protections and drop persistent kernel-level tampering modules.

This report examines how BlackX establishes firmware dominance, manipulates endpoint security tooling, and routes espionage payloads across diplomatic infrastructure, providing systems administrators and security teams with actionable details on mitigation requirements. Despite the availability of patches, the threat actor breached systems running updated operating systems by capitalizing on an operational oversight in how Secure Boot revocations are applied. The following technical analysis walks through the operational mechanics of the bootkit, who remains exposed to its components, and what administrative steps are required to close the firm's identified security gap.

What broke in BlackX UEFI bootkit exploits Baton Drop flaw

BlackX successfully compromised target hosts by reviving the Baton Drop flaw, designated CVE-2022-21894, which allows malicious actors to bypass UEFI Secure Boot defenses during initial machine boot. ESET confirmed in March 2023 that BlackLotus had previously weaponized Baton Drop against fully patched Windows 11 systems, and Kaspersky discovered that BlackX uses an implementation remarkably similar to that predecessor. By abusing this vulnerability, BlackX enrolls custom Machine Owner Keys and executes arbitrary EFI files prior to the initialization of the underlying operating system.

The breakdown stems directly from how security updates were handled on target endpoints. Kaspersky reported that all infected victims were running fully patched Windows releases at the time of compromise. However, the standard Windows security update for Baton Drop did not automatically apply the necessary Secure Boot certificate revocations. Because administrators did not take the separate manual step required to activate these revocations, the vulnerable boot components remained executable, giving BlackX an open path to bypass Secure Boot defenses without triggering operating system blocks.

Who is exposed by BlackX UEFI bootkit exploits Baton Drop flaw

The primary targets identified in this early 2026 espionage campaign were diplomatic agencies situated throughout Central Asia, with observed compromises confirmed in Tajikistan, Uzbekistan, and Turkmenistan. The campaign has been attributed with medium confidence to the Chinese state-sponsored adversary APT41, known to researchers as Brass Typhoon, Wicked Panda, and Barium. Organizations in these regions handling sensitive diplomatic affairs and regional administrative communications faced direct intrusions from this threat group.

Beyond the specific diplomatic targets, any organization running modern Windows environments where administrators relied solely on automated patch routines remains fundamentally exposed to the bootkit. Even though Microsoft issued fixes addressing CVE-2022-21894, the mitigation requires manual activation to revoke the vulnerable binaries. Because systems administrators rarely execute post-patch configuration scripts or manual firmware revocation steps, environments that appear fully updated on patch management dashboards continue to accept vulnerable boot components signed by older certificates.

What to do now about BlackX UEFI bootkit exploits Baton Drop flaw

To defend against BlackX, systems administrators must manually complete the revocation process that prevents vulnerable UEFI binaries from loading. Microsoft designed the Baton Drop patch to revoke the Windows Production PCA 2011 certificate that signs vulnerable components, but administrative intervention is strictly necessary to trigger this revocation. Relying on default update mechanics leaves systems vulnerable, so administrators must follow manual patching instructions to ensure the revocation list actively blocks the older boot assets.

Kaspersky researchers specifically warn that the October 19, 2026 expiration date of the Windows Production PCA 2011 certificate does not stop vulnerable binaries from executing on Windows endpoints. Unless security teams actively place the certificate into their local blocklist or enforce the manual Secure Boot revocation steps, systems will continue executing the vulnerable files. Network defenders should also monitor for rogue kernel drivers signed by Wenjiang District Mingyu Network Technology Service Studio and watch for unexpected subprocess launches of the Windows Calculator executable.

How the BlackX UEFI bootkit exploits Baton Drop flaw issue works

BlackX operates by loading arbitrary EFI files and enrolling unauthorized Machine Owner Keys, mirroring the exploit mechanics of the BlackLotus bootkit. Once firmware execution is achieved, BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an entity named Wenjiang District Mingyu Network Technology Service Studio. This driver disables endpoint security processes, strips registry callbacks, and tampers with Event Tracing for Windows providers to prevent system logging. When users attempt to inspect or open the bootkit files on disk, the driver intercepts the file requests and opens the Windows Calculator instead.

Following kernel compromise, BlackX delivers secondary espionage payloads to gather intelligence and maintain access. The first payload is a remote access trojan that uses cloud storage platforms including Google Drive, OneDrive, and Yandex.Disk for command-and-control communications, executing .NET payloads and exfiltrating data. The second payload is OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded via googleupdate.exe. It decrypts a file named v8_context_snapshot.bin to launch shellcode and a Rust payload, which retrieves dynamic libraries from archivetj[.]com and runs their create_plugin functions across separate threads.

What is still unknown about BlackX UEFI bootkit exploits Baton Drop flaw

Uncertainty remains regarding the precise development history and supply chain origin of the BlackX codebase. While source code for BlackLotus leaked online in July 2023, that leak was missing critical modules. Kaspersky researchers discovered that BlackX contains specific exploit code that was absent from the public leak repository but present in private, compiled BlackLotus samples. Analysts cannot definitively say whether the APT41-linked developers independently reverse-engineered BlackLotus binaries to recover the missing logic or purchased complete private source code from an underground source.

Additionally, researchers do not have full visibility into the total scope of organizations compromised outside the identified diplomatic bodies in Central Asia. While specific tampering routines in the kernel driver were configured to execute only when detecting software from Kaspersky or Avast, Kaspersky noted that these subversion techniques failed to bypass its protections. It remains unclear what other defensive software BlackX may target in unobserved builds, or how many other threat actors have adapted the unpatched Baton Drop mitigation gap to deploy alternative payloads against enterprise networks.