In early 2026, a new UEFI bootkit, **BlackX**, emerged in an espionage campaign, exploiting the **Baton Drop** vulnerability to bypass Secure Boot. This allowed it to load a malicious driver specifically designed to interfere with security solutions from **Kaspersky** and **Avast**. ### APT41 Link and Regional Targets The operation has been attributed with medium confidence to **APT41**, a Chinese state-sponsored threat group also known as **Brass Typhoon**, **Wicked Panda**, and **Barium**. The campaign, discovered in early 2026, primarily targeted diplomatic agencies in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. ### Similarities to BlackLotus **Kaspersky** researchers analyzed the **BlackX** bootkit and identified significant similarities with **BlackLotus**, a bootkit that has been active on hacker forums since October 2022. **BlackLotus** also leverages the **Baton Drop** vulnerability (**CVE-2022-21894**) to bypass Secure Boot protection. **ESET** confirmed in March 2023 that **BlackLotus** exploited **Baton Drop**, capable of compromising even fully patched **Windows 11** systems at the time. According to **Kaspersky**, **BlackX**'s implementation of the exploit is "remarkably similar" to **BlackLotus**, enabling the enrollment of custom Machine Owner Keys (**MOKs**) and the loading of arbitrary EFI files to bypass Secure Boot. ### Divergence and Origins Despite the similarities in exploit implementation, **BlackX** diverges from **BlackLotus** by deploying a different kernel driver and subsequent payloads. **Kaspersky** suggests that **BlackX** was either derived from reverse-engineering **BlackLotus** or from its source code. The source code for **BlackLotus** was leaked in July 2023, but the release was incomplete. **Kaspersky** researchers found that some **BlackLotus** samples they analyzed contained code missing from the public repository but present in the **BlackX** bootkit. This leads researchers to believe the **BlackX** operator either reverse-engineered **BlackLotus** or acquired its full source code. ### BlackX Capabilities **BlackX** injects a malicious **Windows** kernel driver, signed with a now-revoked certificate issued to "Wenjiang District Mingyu Network Technology Service Studio." This driver performs several critical functions: * Disables security-related processes and registry callbacks. * Tampers with Event Tracing for Windows (**ETW**) providers to obstruct monitoring. Notably, some tampering procedures are configured to run only if **Kaspersky** or **Avast** products are detected on the target host. The driver also protects the bootkit’s files by intercepting user requests to open them and launching **Windows Calculator** instead. Its primary purpose is to deploy the following espionage payloads on infected machines: 1. A Remote Access Trojan (**RAT**) that utilizes **Google Drive**, **OneDrive**, or **Yandex.Disk** for command-and-control (**C2**), executing .NET payloads and facilitating file uploads and downloads. 2. **OxiDLLRunner**, an OLLVM-obfuscated DLL sideloaded by `googleupdate.exe`. This component decrypts `v8_context_snapshot.bin` to launch shellcode and a **Rust** payload, which retrieves DLL plugins from `archivetj[.]com` and executes their 'create_plugin' functions in separate threads. ### The Mitigation Gap: Manual Revocation **Kaspersky** reports that all **BlackX** victims were running fully patched **Windows** releases. However, the bootkit was successful because administrators had not manually activated the additional Secure Boot revocations. "The patch for the **Baton Drop** vulnerability is designed to revoke the 'Windows Production PCA 2011' certificate used to sign vulnerable UEFI components," **Kaspersky** explains. "However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually." Researchers highlight this as a critical gap in the update process, as it is uncommon for administrators to perform manual actions after applying a security update. They believe attackers exploited this gap, investing time to understand **BlackLotus** and create **BlackX**. Instructions to fully patch **Baton Drop** (**CVE-2022-21894**) are available [here](https://techcommunity.microsoft.com/blog/windows-itpro-blog/revoking-vulnerable-windows-boot-managers/4121735). **Kaspersky** warns that the October 19, 2026, expiration date of the "Windows Production PCA 2011" certificate does not prevent vulnerable binaries from loading on **Windows** systems unless administrators explicitly add the certificate to a blocklist.