Clarissa Hana
A sophisticated UEFI bootkit, identified as BlackX, has emerged in early 2026, orchestrating an espionage campaign that adeptly bypassed Secure Boot protections by exploiting the well-documented Baton Drop vulnerability. This advanced malware was designed to load a malicious driver capable of interfering with critical security solutions from prominent cybersecurity firms, Kaspersky and Avast. The operation has been attributed with medium confidence to APT41, a notorious Chinese state-sponsored threat actor also known by aliases such as Brass Typhoon, Wicked Panda, and Barium. The discovery of BlackX’s activities highlights a persistent threat to system integrity at the earliest stages of the boot process, underscoring the evolving tactics of advanced persistent threats.
The BlackX campaign, detected in the early months of 2026, primarily targeted diplomatic entities across Central Asia, with specific focus on organizations within Tajikistan, Uzbekistan, and Turkmenistan. These regions are often focal points for geopolitical intelligence gathering, making them prime targets for state-sponsored espionage operations. The ability of BlackX to bypass Secure Boot, a fundamental security feature designed to ensure that only trusted software loads during the boot process, grants attackers a deep level of control over compromised systems, making detection and remediation significantly more challenging.
Kaspersky’s in-depth analysis of the BlackX bootkit revealed striking similarities to BlackLotus, another UEFI bootkit that has been circulating in underground hacking forums since at least October 2022. Both BlackX and BlackLotus leverage the Baton Drop vulnerability, officially designated as CVE-2022-21894. This vulnerability, a critical flaw in the Windows boot manager, allowed these bootkits to circumvent Secure Boot, even on systems that had been fully patched against other known threats, including Windows 11. ESET had previously confirmed in March 2023 that BlackLotus could successfully exploit Baton Drop on patched Windows 11 systems, a testament to the severity and persistence of this particular exploit.
According to Kaspersky researchers, BlackX’s implementation of the Baton Drop exploit is "remarkably similar" to that observed in BlackLotus. This similarity suggests a shared origin or a high degree of reverse-engineering. The exploit allows attackers to enroll custom Machine Owner Keys (MOKs) into the system’s UEFI firmware. By controlling these keys, attackers can effectively bypass Secure Boot’s integrity checks and load arbitrary EFI (Extensible Firmware Interface) files, thereby establishing a foothold before the operating system even begins to load.
While the core exploit mechanism appears to be shared, BlackX diverges from BlackLotus in its subsequent stages. It deploys a distinct kernel driver and follow-on espionage payloads. This divergence leads Kaspersky to theorize that BlackX was either developed through extensive reverse-engineering of BlackLotus or that its creators gained access to its source code. The public leak of BlackLotus source code in July 2023 on GitHub, while significant, was reportedly incomplete. Kaspersky analysts observed that certain code segments present in analyzed BlackX samples were absent from the publicly available BlackLotus repository. This suggests that the BlackX operators likely acquired this proprietary code through means other than the incomplete public leak, such as direct reverse-engineering or private acquisition of the source code.
BlackX Capabilities and Operational Tactics
The malicious kernel driver injected by BlackX is digitally signed with a certificate issued to an entity named "Wenjiang District Mingyu Network Technology Service Studio." While this certificate has since been revoked, its initial use provided a veneer of legitimacy, potentially aiding in initial evasion. The driver is engineered to perform a range of malicious activities designed to cripple security defenses and facilitate persistent access.
One of its primary functions is to disable security-related processes and registry callbacks. Registry callbacks are critical mechanisms used by security software to monitor changes and detect suspicious activity within the Windows registry. By disabling these, BlackX blinds security solutions to its own malicious modifications. Furthermore, the bootkit tampers with Event Tracing for Windows (ETW) providers. ETW is a robust logging and tracing system used by the operating system and applications for diagnostics and security monitoring. Disrupting ETW significantly hinders the ability of security tools to collect and analyze crucial forensic data, making post-incident investigation extremely difficult.
Kaspersky researchers noted that certain of these tampering procedures are specifically configured to activate only if security products from Kaspersky or Avast are detected on the target host. This targeted approach suggests a deliberate effort to neutralize specific, known defenses. However, the researchers also pointed out that the mechanism employed for this detection and disabling is ultimately ineffective against the companies’ own solutions, indicating a potential oversight or a rapidly evolving countermeasure.
To further evade detection and protect its own components, the BlackX driver intercepts user requests to open its associated files. Instead of revealing the actual malicious files, it launches the Windows Calculator application. This deceptive tactic aims to mislead users and security analysts into believing a benign process is running, thereby masking the presence of the bootkit.
Beyond its evasion and anti-analysis capabilities, the core purpose of BlackX is to establish a persistent espionage platform. Following its successful initial infection and establishment of persistence, BlackX deploys a suite of espionage payloads onto the compromised machines. While the specific details of these payloads were not fully elaborated in the initial report, their deployment signifies a clear intent for long-term data exfiltration and surveillance. These payloads likely include tools for credential harvesting, network reconnaissance, lateral movement within the victim’s network, and command-and-control (C2) communication channels for receiving instructions from the attackers and exfiltrating stolen data. The nature of the targets—diplomatic agencies—strongly suggests the types of data being sought would include sensitive government communications, policy documents, and intelligence related to regional political and economic affairs.
The Insufficient Fix: A Critical Gap in Patch Management
Kaspersky’s investigation revealed a critical vulnerability in the patching process that allowed BlackX to succeed, even on systems running fully updated versions of Windows. The root cause lies in how the patch for the Baton Drop vulnerability (CVE-2022-21894) is implemented and requires manual intervention.
The patch itself is designed to revoke the "Windows Production PCA 2011" certificate, which was used to sign vulnerable UEFI components that are susceptible to the Baton Drop exploit. However, this revocation process is not automatic. Upon installation of the security update, administrators are required to manually trigger the certificate revocation. This is a significant oversight in the typical update deployment process for most organizations.
"The patch for the Baton Drop vulnerability is designed to revoke the ‘Windows Production PCA 2011’ certificate used to sign vulnerable UEFI components," Kaspersky explained in their analysis. "However, this revocation does not happen automatically upon patch installation – the user has to trigger it manually."
The researchers highlighted this as a fundamental gap in the update lifecycle. In practice, it is extremely rare for IT administrators to perform manual actions after applying a standard security update. Most patch management systems are designed for automated deployment and minimal post-installation intervention. This reliance on manual action for full mitigation of the Baton Drop vulnerability created a window of opportunity for sophisticated attackers.
Kaspersky believes that the threat actors behind BlackX astutely identified and exploited this mitigation gap. Their decision to invest significant time and resources into understanding and replicating the BlackLotus bootkit was likely driven by the realization that many systems, despite being patched for other vulnerabilities, remained susceptible to UEFI-level attacks due to this manual revocation step being overlooked. This strategic exploitation of a procedural weakness underscores the intelligence and planning involved in advanced persistent threats.
Microsoft has provided detailed instructions on how to fully patch the Baton Drop vulnerability, including the necessary manual revocation steps, on their Tech Community blog. These instructions emphasize the importance of adding the compromised certificate to a blocklist to prevent vulnerable binaries from loading.
Furthermore, the researchers issued a stark warning regarding the expiration of the "Windows Production PCA 2011" certificate. While this certificate is set to expire on October 19, 2026, this expiration date alone does not automatically secure systems. Vulnerable binaries could still potentially load on Windows systems until the certificate is explicitly added to a blocklist by administrators. This means that even as the certificate nears its natural end-of-life, the underlying vulnerability can persist if proactive measures are not taken. The ongoing threat posed by BlackX and similar UEFI bootkits necessitates a comprehensive understanding of firmware security and diligent patch management practices, extending beyond routine operating system updates.
Broader Implications and Future Threats
The emergence of BlackX and its successful exploitation of the Baton Drop vulnerability carry significant implications for cybersecurity across government and critical infrastructure sectors. UEFI bootkits represent one of the most insidious forms of malware due to their ability to compromise the system at its most fundamental level, predating the execution of most security software. This early-stage compromise allows them to remain hidden and exert control over the entire system’s operation.
The fact that BlackX targeted diplomatic agencies in Central Asia suggests a clear geopolitical motive, likely aimed at intelligence gathering and influencing regional affairs. The focus on Kaspersky and Avast indicates a targeted effort to disable known, robust security solutions, demonstrating a level of sophistication in understanding the threat landscape.
The reliance on a manually triggered patch for full mitigation highlights a broader challenge in cybersecurity: the gap between technical fixes and operational reality. Even the most robust patches can be rendered ineffective if not implemented correctly and comprehensively by system administrators. This emphasizes the need for continuous training and awareness programs for IT security professionals, as well as for vendors to explore more automated and fail-safe mechanisms for critical security updates.
The evolution from BlackLotus to BlackX, whether through direct code reuse or sophisticated reverse-engineering, signals a trend of malware families being adapted and improved by different threat actors. This iterative development cycle makes it challenging for the cybersecurity community to stay ahead, as new variants with enhanced capabilities can emerge rapidly.
Looking ahead, the persistence of the Baton Drop vulnerability, coupled with the increasing availability of sophisticated UEFI exploit tools (whether leaked or developed independently), suggests that UEFI-level attacks will remain a significant threat. Organizations must prioritize securing their firmware, implementing robust boot-time integrity checks, and ensuring that all security updates, particularly those affecting boot processes, are applied with meticulous attention to detail. The incident serves as a critical reminder that comprehensive security requires vigilance not only at the operating system level but also at the deepest layers of system firmware. The continued threat landscape necessitates a multi-layered defense strategy that accounts for the earliest stages of system startup.
