GoKawiilNew BlackX bootkit reuses BlackLotus exploit to bypass Windows Secure Boot
Kaspersky researchers identified a new UEFI bootkit called BlackX, used in an espionage campaign against diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan in early 2026. The malware exploits the years-old Baton Drop flaw (CVE-2022-21894) to bypass Secure Boot and load a malicious kernel driver aimed at disrupting Kaspersky and Avast security software, with the operation tentatively linked to the Chinese state-backed group APT41.