Security48 mOctober 24, 2026, 21:17

BlackX UEFI bootkit uses Baton Drop to bypass Secure Boot

Kaspersky found a new UEFI bootkit, BlackX, used in an early 2026 espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. It exploits the Baton Drop flaw (CVE-2022-21894) much like BlackLotus and loads a driver signed with a revoked certificate that disables Kaspersky and Avast protections. The operation is attributed to APT41 with medium confidence.

BleepingComputer

Open source

BlackX UEFI bootkit uses Baton Drop to bypass Secure Boot

BlackX bypasses Secure Boot via CVE-2022-21894, like BlackLotus
Targets were diplomatic agencies in Tajikistan, Uzbekistan, Turkmenistan
Driver signed with revoked Wenjiang District Mingyu certificate
Windows Production PCA 2011 revocation is not applied automatically

#Kaspersky#APT41#BlackLotus#Windows

Kaspersky: APT41 hit Central Asian diplomats with BlackX bootkit via Baton Drop

Security

Laser Injection Attack Bypasses RP2350 Secure Boot and TrustZone

Security

Africa cybercrime crackdown nets 1,462 arrests and over $105 million

Security

BlackX UEFI bootkit uses Baton Drop to bypass Secure Boot

Kaspersky: APT41 hit Central Asian diplomats with BlackX bootkit via Baton Drop

Laser Injection Attack Bypasses RP2350 Secure Boot and TrustZone

Africa cybercrime crackdown nets 1,462 arrests and over $105 million

Lazarus uses post-quantum cryptography for malware delivery