Kaspersky researchers have identified a UEFI bootkit designated BlackX that was deployed during an espionage campaign beginning in early 2026. The malware leverages the Baton Drop vulnerability to circumvent Secure Boot protections and install a malicious kernel driver that targets security products from Kaspersky and Avast. The campaign has been attributed with medium confidence to APT41, a Chinese state-sponsored group also referred to as Brass Typhoon, Wicked Panda, and Barium.

The bootkit was discovered targeting diplomatic agencies in Central Asia, with focus on Tajikistan, Uzbekistan, and Turkmenistan. Kaspersky's analysis revealed substantial technical overlap between BlackX and BlackLotus, an earlier bootkit that has circulated in hacker forums since October 2022 and similarly exploited Baton Drop (CVE-2022-21894) to disable Secure Boot. ESET confirmed in March 2023 that BlackLotus could compromise even fully patched Windows 11 systems by leveraging this vulnerability.

The implementation of the exploit in BlackX mirrors BlackLotus's approach closely. According to Kaspersky researchers, the bootkit achieves bypass by enrolling custom Machine Owner Keys (MOKs) and loading arbitrary EFI files to circumvent Secure Boot protections. Despite these similarities, BlackX deploys distinct kernel drivers and follow-on payloads compared to its predecessor.

Kaspersky researchers determined that BlackX was either created through reverse-engineering BlackLotus or derived from its source code. Although BlackLotus source code was leaked in July 2023, the release proved incomplete. Researchers discovered that certain BlackLotus samples they examined contained code absent from the public repository but present in BlackX, suggesting the attacker either reverse-engineered the original bootkit or obtained its source code through other means.

BlackX capabilities

BlackX deploys a malicious Windows kernel driver signed with a now-revoked certificate belonging to an entity called Wenjiang District Mingyu Network Technology Service Studio. The driver performs multiple functions designed to evade detection and maintain persistence.

The driver disables security-related processes and registry callbacks while tampering with Event Tracing for Windows (ETW) providers to obstruct system monitoring. Notably, some tampering routines activate only when Kaspersky or Avast products are detected on the target system, though Kaspersky notes these mechanisms prove ineffective against its own solutions. The driver also protects bootkit files by intercepting file access requests and launching the Windows Calculator instead.

Beyond these evasion techniques, the driver facilitates deployment of espionage payloads on compromised machines:

  1. A remote access trojan (RAT) that leverages Google Drive, OneDrive, or Yandex.Disk for command-and-control communications, enabling execution of .NET payloads and file transfer operations.
  2. OxiDLLRunner, an OLLVM-obfuscated DLL sideloaded through googleupdate.exe that decrypts v8_context_snapshot.bin to launch shellcode and a Rust payload, which retrieves DLL plugins from archivetj[.]com and executes their 'create_plugin' functions in separate threads.

Insufficient fix

All BlackX victims were running fully patched Windows systems, yet the bootkit succeeded nonetheless. The reason lies in a critical gap in how the Baton Drop patch is applied. Kaspersky explains that "the patch for the Baton Drop vulnerability is designed to revoke the 'Windows Production PCA 2011' certificate used to sign vulnerable UEFI components. However, this revocation does not happen automatically upon patch installation - the user has to trigger it manually."

This manual activation requirement represents a significant weakness in the update process. Kaspersky researchers note that it is exceptionally rare for administrators to perform manual actions following security patch deployment. The researchers conclude that the attacker exploited this mitigation gap deliberately, choosing to invest effort in understanding BlackLotus and developing a functionally equivalent bootkit.

Kaspersky warns that the October 19, 2026 expiration date of the "Windows Production PCA 2011" certificate will not prevent vulnerable binaries from executing on Windows systems unless administrators explicitly add the certificate to a blocklist. Complete patching instructions for Baton Drop (CVE-2022-21894) are available through Microsoft.