BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX .
Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus , which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.
BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts.
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.
The Russian cybersecurity company discovered that attackers are capitalizing on the fact that organizations have not carried out these manual steps, allowing them to continue using the Baton Drop vulnerability even on systems where the "patch" has been applied.
The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.
The Slovakian cybersecurity company said it had found "limited indications" that some versions of the backdoor may feature a UEFI bootkit component likely exploiting CVE‑2023‑24932 , a bypass for the mitigations introduced by Microsoft to fix CVE-2022-21894.
According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.
It represents a downgrade attack in which a privileged attacker can force the operating system to boot using an older, legitimately Microsoft-signed version of the Windows Boot Manager to reintroduce CVE-2022-21894.
They believe that the attacker used this mitigation gap to their advantage and "decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit." Instructions to fully patch Baton Drop (CVE-2022-21894) are available here .
Notably, BlackX is assessed to be an updated version of BlackLotus , a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023.
What happened
Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus , which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection.
BlackLotus is designed to exploit a now-patched Secure Boot bypass vulnerability tracked as CVE-2022-21894 (CVSS score: 4.4), also known as Baton Drop, to load malicious code before the operating system starts.
What changed
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.
The Russian cybersecurity company discovered that attackers are capitalizing on the fact that organizations have not carried out these manual steps, allowing them to continue using the Baton Drop vulnerability even on systems where the "patch" has been applied.
Who is affected
The primary objective behind deploying the malware is to undermine Microsoft Windows startup defenses, along with third-party security solutions, while maintaining long-term, covert access to compromised devices.
The Slovakian cybersecurity company said it had found "limited indications" that some versions of the backdoor may feature a UEFI bootkit component likely exploiting CVE‑2023‑24932 , a bypass for the mitigations introduced by Microsoft to fix CVE-2022-21894.
Why it matters
According to Kaspersky researchers, BlackX's implementation of the exploit is "remarkably similar" to the one used by BlackLotus, allowing the attacker to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files to bypass Secure Boot protections.
It represents a downgrade attack in which a privileged attacker can force the operating system to boot using an older, legitimately Microsoft-signed version of the Windows Boot Manager to reintroduce CVE-2022-21894.
Technical details
They believe that the attacker used this mitigation gap to their advantage and "decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit." Instructions to fully patch Baton Drop (CVE-2022-21894) are available here .
Notably, BlackX is assessed to be an updated version of BlackLotus , a notorious bootkit that was first observed being advertised on cybercrime forums in late 2022, before its existence was officially confirmed by ESET in March 2023.
The binary then drops more files to both system and UEFI partitions to exploit CVE-2022-21894 in a manner that's "remarkably similar" to the one used in BlackLotus.
Response
ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.
As such, we believe they decided to invest time in understanding how BlackLotus works and creating a copycat of this bootkit." Attackers have been observed deploying BlackX after breaching victim networks through an unspecified method and gaining administrator privileges.
What security teams should do
The researchers warn that the October 19, 2026 expiration date of the “Windows Production PCA 2011” certificate does not stop the vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist.
Its purpose is also to deploy the following espionage payloads on infected machines: Kaspersky says that all BlackX victims used a fully patched Windows release.
Attribution
The Hacker News: Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX .
BleepingComputer: A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.