BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Kaspersky researchers have uncovered a new UEFI bootkit called BlackX, used in an espionage campaign that began in early 2026 against diplomatic targets in Tajikistan, Uzbekistan and Turkmenistan. The malware is linked with medium confidence to the Chinese state-sponsored group APT41 (also tracked as Brass Typhoon, Wicked Panda, Barium) and relies on the long-known Baton Drop flaw (CVE-2022-21894) to circumvent Secure Boot, closely mirroring techniques from the earlier BlackLotus bootkit. Once active, BlackX loads a revoked-certificate kernel driver that shuts down security processes, blinds ETW logging—specifically against Kaspersky and Avast—and hides its own files, then deploys a cloud-based RAT and a Rust/DLL loader dubbed OxiDLLRunner to carry out espionage tasks. Crucially, every known victim had installed Microsoft's patch for the bug, but because the fix requires administrators to separately and manually enroll the certificate revocation, unpatched systems in practice remained exploitable, highlighting a dangerous gap in standard update procedures.