BlackX bootkit uses Baton Drop to bypass Secure Boot
Original title: BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
Kaspersky analyzed BlackX, a UEFI bootkit used in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. It exploited CVE-2022-21894, known as Baton Drop, to enroll custom Machine Owner Keys and load EFI files despite Secure Boot. Attribution to APT41 is medium confidence. A driver signed with a now-revoked certificate interfered with Kaspersky and Avast monitoring and deployed remote-access and plugin-loading payloads.
Unconfirmed: Kaspersky attributes the campaign to APT41 with medium confidence and infers how the operators obtained BlackLotus code.
- BlackX resembles BlackLotus, whose incomplete source leaked in July 2023.
- The driver certificate was issued to Wenjiang District Mingyu Network Technology Service Studio.
- Command-and-control used Google Drive, OneDrive, or Yandex.Disk.
- OxiDLLRunner was sideloaded by googleupdate.exe and pulled plugins from archivetj[.]com.
- Windows Production PCA 2011 expires October 19, 2026, but still needs a blocklist.
Impact: Secure Boot bypass and a driver that disrupts security tools
| Product | Affected |
|---|---|
| Microsoft Windows | fully patched releases without manual Secure Boot revocations |
- 1.Manually apply Secure Boot revocations for CVE-2022-21894, including blocking Windows Production PCA 2011.
- CVEs
- CVE-2022-21894
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- APT41
- Malware
- BlackXBlackLotusOxiDLLRunner
- Organizations
- Kaspersky
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21894 | Secure Boot Security Feature Bypass Vulnerability | 4.4 | 7% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | archivetj.com | llcode and a Rust payload, which retrieves DLL plugins from archivetj[.]com and executes their ‘create_plugin’ functions in separate |
From the original article
3 min read at bleepingcomputer.com
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.