A UEFI bootkit named BlackX, attributed with medium confidence to Chinese state-sponsored group APT41, exploited the Baton Drop vulnerability to bypass Secure Boot on fully patched Windows systems in a 2026 espionage campaign targeting Central Asian diplomatic agencies.
A previously undocumented UEFI bootkit dubbed BlackX was deployed in an espionage campaign beginning in early 2026, exploiting a years-old vulnerability to bypass Secure Boot protections on fully patched Windows systems, according to researchers at Kaspersky.
The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also tracked under the names Brass Typhoon, Wicked Panda, and Barium. Targets included diplomatic agencies in Central Asia — specifically in Tajikistan, Uzbekistan, and Turkmenistan.
BlackX leverages CVE-2022-21894, known as the Baton Drop vulnerability, the same flaw exploited by BlackLotus, a bootkit that has circulated on hacker forums since October 2022. ESET confirmed in March 2023 that BlackLotus used Baton Drop to compromise even fully patched Windows 11 systems.
Kaspersky researchers found that BlackX's implementation of the exploit is "remarkably similar" to that of BlackLotus, enabling attackers to enroll custom Machine Owner Keys and load arbitrary EFI files that circumvent Secure Boot protections. The researchers note, however, that BlackX deploys a different kernel driver and distinct follow-on payloads.
The research team believes the attacker either reverse-engineered BlackLotus or obtained its source code. While the BlackLotus source code was leaked in July 2023, that release was incomplete. Kaspersky found code present in BlackX samples that was missing from the public repository, suggesting the operator sourced the material through other means.
BlackX injects a malicious Windows kernel driver signed with a now-revoked certificate issued to an entity named Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows providers to obstruct system monitoring. Some of those tampering procedures activate only when Kaspersky or Avast products are detected on a target host — though Kaspersky notes those routines are ineffective against its own solutions.
The driver also intercepts user requests to open bootkit files and launches the Windows Calculator instead, shielding the malicious components from manual inspection.
Among the espionage payloads deployed on infected machines is a remote access tool that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control, enabling execution of .NET payloads and file transfers. A second component, OxiDLLRunner, is an OLLVM-obfuscated DLL sideloaded by googleupdate.exe that decrypts a file to launch shellcode and a Rust payload, which retrieves plugins from archivetj[.]com and executes them in separate threads.
That all BlackX victims ran fully patched Windows releases underscores a critical gap in the update process. The patch for Baton Drop is designed to revoke the "Windows Production PCA 2011" certificate used to sign vulnerable UEFI components — but, as Kaspersky explains, "this revocation does not happen automatically upon patch installation — the user has to trigger it manually."
Kaspersky describes this as an exploitable mitigation gap, noting it is extremely uncommon for administrators to take manual action following a security update. The researchers believe the attacker identified this gap and invested time replicating BlackLotus functionality specifically to take advantage of it.
Separately, Kaspersky researchers warn that the October 19, 2026 expiration of the "Windows Production PCA 2011" certificate does not, on its own, prevent vulnerable binaries from loading on Windows systems — administrators must explicitly add the certificate to a blocklist.
Instructions to fully apply the Baton Drop mitigation are available via Microsoft's guidance documentation. With a state-sponsored actor now demonstrably weaponizing the gap between patch installation and manual revocation steps, security teams operating in high-risk environments face mounting pressure to audit whether that additional step has been completed on systems under their management.
Marc Sabatini is a staff writer at TechEchelon covering enterprise software, cybersecurity, and the regulatory beats that shape both. He focuses on the deal flow and policy decisions that move markets.
More from Marc →Quest Diagnostics confirmed a data breach affecting patient records after a threat actor gained unauthorized access to its Quanum LSM laboratory management platform, the company disclosed in an SEC filing on October 23.
Capcom confirmed unauthorized access to its CAPCOM ID platform exposed data from more than 11.7 million customer accounts, including email addresses, login metadata, and for a small subset, additional personal details.
The PHP security team released emergency patches for two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affecting all PHP installations that serve web requests, with early exploitation already observed in the wild.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.