BlackX Bootkit Exploits Baton Drop to Bypass Secure Boot

A UEFI bootkit called BlackX exploited the Baton Drop vulnerability to bypass Secure Boot protections during an espionage campaign discovered in early 2026, according to BleepingComputer, citing Kaspersky researchers. The campaign targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan and Turkmenistan.

Researchers found that BlackX uses an exploit implementation similar to BlackLotus, which also exploited Baton Drop (CVE-2022-21894). The technique can enroll custom Machine Owner Keys and load arbitrary EFI files. BlackX uses a different kernel driver and follow-on payloads. Kaspersky said the bootkit may have been derived from reverse-engineering BlackLotus or from its source code; researchers found BlackX code absent from the incomplete public leak of BlackLotus source code.

BlackX loads a malicious Windows kernel driver signed with a now-revoked certificate. The driver can disable security processes, interfere with registry callbacks and tamper with Event Tracing for Windows providers. Some procedures are configured to run when Kaspersky or Avast products are detected. The driver also protects bootkit files by intercepting attempts to open them and launching Windows Calculator instead.

Kaspersky said all identified victims used fully patched Windows releases. The bootkit still worked because administrators had not manually applied additional Secure Boot certificate revocations. Installing the Baton Drop patch does not trigger that revocation automatically, the researchers said. They also warned that the “Windows Production PCA 2011” certificate’s October 19, 2026 expiration does not block vulnerable binaries unless administrators add the certificate to a blocklist.