BlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Boot
Summary
Kaspersky researchers detail BlackX, a UEFI bootkit used in an early-2026 espionage campaign targeting Central Asian diplomatic agencies. It exploited Baton Drop to bypass Secure Boot; the report describes its security-disabling driver, espionage payloads and manual-rev
Key points
- BlackX was discovered in an early-2026 espionage campaign targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan.
- The operation was attributed to APT41 with medium confidence.
- Researchers say BlackX exploits Baton Drop (CVE-2022-21894), using a method similar to BlackLotus to enroll custom Machine Owner Keys and load arbitrary EFI files.
- BlackX's kernel driver can disable security processes and registry callbacks and tamper with Event Tracing for Windows providers.
- The bootkit deploys a RAT that uses Google Drive, OneDrive or Yandex.Disk for command-and-control, as well as OxiDLLRunner, which launches shellcode and a Rust payload.
- Kaspersky says victims had fully patched Windows, but the relevant Secure Boot certificate revocation had not been manually activated.
- Researchers suggest BlackX was derived from reverse-engineering BlackLotus or obtaining its source code; they found code in BlackX samples that was absent from the public leak.
Article Details
- Attack Vectors
- BlackX exploited Baton Drop (CVE-2022-21894) to bypass Secure Boot, enroll custom Machine Owner Keys, and load arbitrary EFI files.
- The bootkit loaded a malicious Windows kernel driver signed with a now-revoked certificate. The driver disabled security-related processes and registry callbacks and tampered with ETW providers.
- OxiDLLRunner was sideloaded by googleupdate.exe; it decrypted v8_context_snapshot.bin to launch shellcode and a Rust payload.
- The Rust payload retrieved DLL plugins from archivetj[.]com and executed their create_plugin functions.
- A RAT used Google Drive, OneDrive, or Yandex.Disk for command and control and to upload and download files.
- Defensive Notes
- Installing the Baton Drop patch does not automatically revoke the vulnerable “Windows Production PCA 2011” certificate; administrators must trigger the revocation manually.
- Kaspersky researchers warn that the certificate’s October 19, 2026 expiration does not prevent vulnerable binaries from loading unless administrators add the certificate to a blocklist.
- Kaspersky reported that the victims were running fully patched Windows releases, but the bootkit succeeded because the additional Secure Boot revocations had not been activated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | archivetj[.]com | Domain from which the BlackX payload retrieved DLL plugins. |
MITRE ATT&CK
T1014 · RootkitThe bootkit protected its files by intercepting user requests to open them and launching Windows Calculator instead.T1027 · Obfuscated Files or InformationOxiDLLRunner was described as OLLVM-obfuscated.T1102.002 · Bidirectional CommunicationThe RAT used Google Drive, OneDrive, or Yandex.Disk for command and control and file uploads and downloads.T1105 · Ingress Tool TransferThe Rust payload retrieved DLL plugins from archivetj[.]com.T1542.003 · BootkitBlackX used a UEFI bootkit to load arbitrary EFI files and bypass Secure Boot.T1553.002 · Code SigningBlackX loaded a malicious kernel driver signed with a now-revoked certificate.T1562.001 · Disable or Modify ToolsThe driver disabled security-related processes and registry callbacks, including procedures configured to act when Kaspersky or Avast products were detected.T1562.006 · Indicator BlockingThe driver tampered with ETW providers to obstruct monitoring.T1574.002 · DLL Side-LoadingOxiDLLRunner was sideloaded by googleupdate.exe.
CVE
Threat Actors
Malware
BlackLotusKaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) toBlackXBlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure BootOxiDLLRunnerOxiDLLRunner, an OLLVM-obfuscated DLL sideloaded by googleupdate.exe.
Vendors
Products
Google DriveA RAT that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and upload and download files.Microsoft OneDriveA RAT that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and upload and download files.Microsoft WindowsESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.Secure BootBlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure BootYandex DiskA RAT that uses Google Drive, OneDrive, or Yandex.Disk for command-and-control (C2) to execute .NET payloads and upload and download files.
Countries
TajikistanIt was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.TurkmenistanIt was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.UzbekistanIt was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan.