A newly identified UEFI bootkit called BlackX was used in an early 2026 espionage campaign targeting diplomatic institutions in Tajikistan, Uzbekistan and Turkmenistan. The malware exploited the older Baton Drop vulnerability to bypass Secure Boot and load malicious drivers that interfere with Kaspersky and Avast security products. Kaspersky researchers assess with medium confidence that the campaign was conducted by APT41, the Chinese state-sponsored group also known as Brass Typhoon, Wicked Panda and Valium.
BlackX builds on BlackLotus techniques
Kaspersky researchers analyzed BlackX and found similarities with BlackLotus, a bootkit that has circulated on hacker forums since October 2022. BlackLotus exploits the Baton Drop vulnerability, tracked as CVE-2022-21894, to bypass Secure Boot protections.
ESET confirmed in March 2023 that BlackLotus could exploit Baton Drop to compromise fully patched Windows 11 systems at that time.
According to Kaspersky, BlackX uses an exploit implementation that is “very similar” to BlackLotus’s. The technique allows attackers to register a custom Machine Owner Key (MOK) and load arbitrary EFI files despite Secure Boot protections.
BlackX differs from BlackLotus in the kernel drivers and subsequent payloads it deploys. Kaspersky Lab has suggested that BlackX was reverse-engineered from, or derived from, BlackLotus source code.
BlackLotus’s source code was leaked in July 2023, although the release was incomplete. Kaspersky Lab researchers found that some BlackLotus samples they analyzed contained code absent from public repositories but present in the BlackX bootkit.
Because BlackX’s operators may not have obtained that code from the leaked repository, the researchers believe they either reverse-engineered BlackLotus or purchased its source code.
BlackX features
BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an organization named Wenjiang District Mingyu Network Technology Service Studio.
The driver disables security-related processes and registry callbacks, and tampers with the Event Tracing for Windows (ETW) provider to prevent monitoring.
Some tampering steps run only when the driver detects a Kaspersky or Avast product on the target system. Kaspersky researchers noted that this mechanism is ineffective against the company’s security solutions.
The driver also protects the bootkit files by intercepting user requests to open them and launching Windows Calculator instead. Its broader purpose is to deploy the next espionage payload on the infected machine.
- A remote access trojan (RAT) that uses Google Drive, OneDrive or Yandex.Disk for command and control (C2), executes .NET payloads, and uploads and downloads files.
- OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by
googleupdate.exe. It decryptsv8_context_snapshot.binto launch shellcode and a Rust payload, retrieves a DLL plugin fromarchivetj.[.]com, and runs thecreate_pluginfunction in a separate thread.
Windows patch did not fully block the attack
Kaspersky said all known BlackX victims were running fully patched versions of Windows. However, the bootkit remained effective because administrators had not manually enabled the additional Secure Boot revocation required to block it.
“The patch for the Baton Drop vulnerability is designed to disable the ‘Windows Production PCA 2011’ certificate used to sign vulnerable UEFI components,” Kaspersky explains.
“However, this revocation does not occur automatically when the patch is installed; the user must manually retract it.”
Researchers described this as a gap in the update process because administrators rarely take manual action after installing a security update.
They believe the attackers exploited this mitigation gap and “decided to invest their time in understanding how BlackLotus works and creating a copycat of this bootkit.”
Microsoft’s steps for fully addressing Baton Drop (CVE-2022-21894) are available here.
Researchers warn that the Windows Production PCA 2011 certificate’s expiration on October 19, 2026, will not by itself prevent vulnerable binaries from loading on Windows systems. Administrators must add the certificate to a blocklist for those binaries to be blocked.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com