GoKawiilNew BlackX bootkit reuses BlackLotus exploit to bypass Windows Secure Boot
Kaspersky researchers identified a new UEFI bootkit called BlackX, used in an espionage campaign against diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The malware exploits the years-old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot and load a malicious kernel driver aimed at disrupting Kaspersky and Avast security software, with the operation tentatively linked to the Chinese state-backed group APT41.
GoKawiil's interpretation of the reporting above, not reported fact.
The reappearance of a Secure Boot bypass first seen in BlackLotus in 2022 suggests that even years-old firmware vulnerabilities can remain attractive to sophisticated actors when patching across the UEFI ecosystem is slow or incomplete. Kaspersky's finding that BlackX contains code absent from the publicly leaked BlackLotus source suggests the attacker may have reverse-engineered the bootkit or acquired proprietary code, which could indicate a broader black market for advanced firmware-level malware. Attribution to APT41 with only medium confidence means the campaign's sponsorship remains an inference rather than a confirmed fact.
- BlackX exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot, mirroring techniques used by BlackLotus.
- The campaign targeted diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan and has been tentatively attributed to APT41 with medium confidence.
- BlackX contains code missing from the publicly leaked BlackLotus source, suggesting reverse-engineering or acquisition of proprietary source code by the attacker.
YubiKey 5C NFC Security Key — Firmware-level attacks like BlackX show why relying solely on OS-level protections like Secure Boot isn't enough, especially for high-value targets like diplomatic staff. A hardware security key adds a strong, phishing-resistant authentication layer that helps protect accounts even if the underlying system is compromised at the boot level.”,
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-24
Published there as: “BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.