BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
76
Malware
BlackX
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenOct 22, 2026
- Last mentioned1d ago
Timeline
5 articles · newest firstBlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
74
BlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
74
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
76
APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
76
Related CVEs
by mentions- CVE-2022-218947%4.4Secure Boot Security Feature Bypass Vulnerability
Appears with
- APT41threat actor · 5
- Microsoftvendor · 5
- Windowsproduct · 5
- OxiDLLRunnermalware · 5
- BlackLotusmalware · 5
- Kasperskyorganization · 3
- ESETorganization · 1
- Wenjiang District Mingyu Network Technology Service Studioorganization · 1
- Securelistorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.