BlackX UEFI Bootkit Exploits Baton Drop Vulnerability in Espionage Campaign

A new UEFI bootkit dubbed BlackX has been identified in an espionage campaign targeting diplomatic organisations in Central Asia. The malware exploits a known vulnerability in the Windows boot process to bypass Secure Boot protections and deploy persistent kernel-level payloads.

Analysis from Kaspersky researchers indicates that the campaign, which emerged in early 2026, primarily targeted government entities in Tajikistan, Uzbekistan, and Turkmenistan. Security analysts have attributed the activity with medium confidence to the Chinese state-sponsored threat group APT41, also known as Brass Typhoon or Wicked Panda.

Exploiting the Baton Drop Flaw

BlackX relies on CVE-2022-21894, a vulnerability known as “Baton Drop”. This flaw allows attackers to bypass Secure Boot by enrolling custom Machine Owner Keys (MOKs) and loading unauthorised Extensible Firmware Interface (EFI) files.

Although Microsoft previously released patches for this vulnerability, the exploit remains effective on many systems. This is because the update process does not automatically revoke the “Windows Production PCA 2011” certificate used to sign vulnerable components. System administrators must manually trigger these revocations to fully secure the boot environment and prevent the loading of compromised binaries.

The bootkit appears to be a sophisticated evolution of the BlackLotus malware, which first gained notoriety in 2022. While BlackX shares the same exploitation method as its predecessor, it deploys unique kernel drivers and subsequent espionage payloads, suggesting the operators may have reverse-engineered the original BlackLotus code or purchased its source code.

Kernel Driver and Espionage Payloads

Once active, BlackX installs a malicious Windows kernel driver signed with a now-revoked certificate. This driver is designed to obstruct monitoring by tampering with Event Tracing for Windows (ETW) and disabling security-related registry callbacks.

The driver includes specific routines to interfere with security solutions from Kaspersky and Avast if they are detected on the host. It also protects its own files by intercepting user requests; if a user attempts to open a malicious file associated with the bootkit, the driver instead launches the Windows Calculator to mask the activity.

The bootkit facilitates the deployment of two primary espionage tools:

• A Remote Access Trojan (RAT) that uses legitimate cloud services, including Google Drive, OneDrive, and Yandex.Disk, for command-and-control (C2) communication.
• OxiDLLRunner, an obfuscated loader that executes shellcode and Rust-based payloads to retrieve additional plugins from external domains.

Mitigation Requirements

The persistence of BlackX highlights a critical gap in the standard Windows update lifecycle. Because the “Windows Production PCA 2011” certificate was not scheduled to expire until late 2026, vulnerable binaries can still be loaded on fully patched systems unless administrators explicitly add the certificate to a blocklist.

To defend against this threat, organisations are advised to follow Microsoft’s guidance on manually activating Secure Boot revocations. Relying solely on automated security updates is currently insufficient to neutralise the risks posed by UEFI bootkits exploiting the Baton Drop vulnerability.