APT41-linked BlackX UEFI bootkit used Baton Drop Secure Boot bypass against Windows systems at Central Asian diplomatic agencies

Updated: 2026.10.24 19H ago 1 sources

Threat Actors & APTs Malware Zero-Days & CVEs

Kaspersky says a new UEFI bootkit called BlackX was used in an early-2026 espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. The malware abused the Baton Drop Secure Boot bypass flaw, CVE-2022-21894, to load malicious EFI components and a signed Windows kernel driver even on fully patched systems where extra Secure Boot revocations were not manually enabled. Kaspersky attributes the activity with medium confidence to APT41 and says the bootkit deployed follow-on espionage payloads and selectively tampered with defenses from Kaspersky and Avast.

Why it matters: This matters because patching Windows alone may not block this class of boot-level attack if administrators never applied the separate Secure Boot certificate revocations. Organizations using Windows in sensitive environments should verify Baton Drop revocations are enabled, review boot integrity controls, and investigate for signs of unauthorized EFI components or drivers.

Sources

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Bill Toulas 2026.10.24 100% relevant

This article establishes a distinct campaign and malware family: BlackX is a separate UEFI bootkit operation, newly linked to APT41 and specific diplomatic targets, rather than a generic update on BlackLotus or Baton Drop alone.