--- title: New BlackX UEFI bootkit exploiting Baton Drop | daily.dev description: Kaspersky found a new UEFI bootkit, BlackX, used in an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploits... canonical: https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New BlackX UEFI bootkit exploiting Baton Drop | daily.dev og:description: Kaspersky found a new UEFI bootkit, BlackX, used in an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploits... og:url: https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv og:image: https://api.daily.dev/og/posts/uPCtLyxPv.png og:image:alt: New BlackX UEFI bootkit exploiting Baton Drop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New BlackX UEFI bootkit exploiting Baton Drop **[Securelist](https://daily.dev/sources/securelist)** · 8 min read · 0 upvotes · 0 comments ## Summary Kaspersky found a new UEFI bootkit, BlackX, used in an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploits the Baton Drop vulnerability (CVE-2022-21894), closely mirroring the BlackLotus bootkit, to install custom Machine Owner Keys and bypass Secure Boot. Even fully patched machines got infected because Microsoft's patch doesn't automatically revoke the vulnerable 'Windows Production PCA 2011' certificate; users must manually set a registry flag and run a scheduled task. Kaspersky attributes the campaign to APT41 with medium confidence, based on shared identifiers with an ESET-reported FishMonger campaign, DLL sideloading patterns, and OLLVM obfuscation common among Chinese-speaking threat actors. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the BlackX UEFI bootkit and how does it relate to BlackLotus? BlackX is a UEFI bootkit discovered in early 2026 in an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. It closely resembles BlackLotus, exploiting the same Baton Drop vulnerability (CVE-2022-21894) to install custom Machine Owner Keys and bypass Secure Boot, though its kernel driver and payloads differ from BlackLotus's. _Teams tracking bootkit threats can follow new UEFI and Secure Boot research on daily.dev._ ### Why are fully patched Windows machines still vulnerable to the Baton Drop (CVE-2022-21894) exploit? The patch for Baton Drop revokes the vulnerable 'Windows Production PCA 2011' certificate, but this revocation does not happen automatically on installation. An administrator must manually set a registry flag in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot and ensure a scheduled task named Secure-Boot-Update runs, steps Microsoft buried deep in its documentation. _Admins hardening Secure Boot deployments can keep up with patch pitfalls like this via daily.dev._ ### Why is the BlackX bootkit campaign attributed to APT41? Kaspersky attributes BlackX to APT41 with medium confidence based on three signals: the identifier 'xdd' appearing in BlackX payloads matches a PDB path seen in an ESET report on the related FishMonger actor, the use of DLL sideloading paired with an encrypted payload file is common among Chinese-speaking threat actors, and the OxiDLLRunner payload uses OLLVM obfuscation, also typical of Chinese-speaking groups. _Threat intel analysts tracking APT41 activity can follow attribution research like this on daily.dev._ ## Similar posts on daily.dev - [Microsoft shares mitigation for YellowKey Windows zero-day](https://daily.dev/posts/microsoft-shares-mitigation-for-yellowkey-windows-zero-day-2olumopys) · BleepingComputer · 0 upvotes · 0 comments - [Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine](https://daily.dev/posts/trojanized-eset-installers-drop-kalambur-backdoor-in-phishing-attacks-on-ukraine-amw6o2ru1) · The Hacker News · 1 upvotes · 0 comments - [Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift](https://daily.dev/posts/russian-spies-give-matchboil-malware-a-stealthy-facelift-nu7j4gk9z) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#windows](https://daily.dev/tags/windows) [View this post on daily.dev](https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New BlackX UEFI bootkit exploiting Baton Drop","url":"https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv"},"datePublished":"2026-10-22T06:11:33.166Z","dateModified":"2026-10-22T06:50:34.367Z","description":"Kaspersky found a new UEFI bootkit, BlackX, used in an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploits...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e28fc590f27a5c59c2add3563e4694e2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e28fc590f27a5c59c2add3563e4694e2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,windows","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"New BlackX UEFI bootkit exploiting Baton Drop"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-blackx-uefi-bootkit-exploiting-baton-drop-upctlyxpv#faq","mainEntity":[{"@type":"Question","name":"What is the BlackX UEFI bootkit and how does it relate to BlackLotus?","acceptedAnswer":{"@type":"Answer","text":"BlackX is a UEFI bootkit discovered in early 2026 in an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. It closely resembles BlackLotus, exploiting the same Baton Drop vulnerability (CVE-2022-21894) to install custom Machine Owner Keys and bypass Secure Boot, though its kernel driver and payloads differ from BlackLotus's. Teams tracking bootkit threats can follow new UEFI and Secure Boot research on daily.dev."}},{"@type":"Question","name":"Why are fully patched Windows machines still vulnerable to the Baton Drop (CVE-2022-21894) exploit?","acceptedAnswer":{"@type":"Answer","text":"The patch for Baton Drop revokes the vulnerable 'Windows Production PCA 2011' certificate, but this revocation does not happen automatically on installation. An administrator must manually set a registry flag in HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Secureboot and ensure a scheduled task named Secure-Boot-Update runs, steps Microsoft buried deep in its documentation. Admins hardening Secure Boot deployments can keep up with patch pitfalls like this via daily.dev."}},{"@type":"Question","name":"Why is the BlackX bootkit campaign attributed to APT41?","acceptedAnswer":{"@type":"Answer","text":"Kaspersky attributes BlackX to APT41 with medium confidence based on three signals: the identifier 'xdd' appearing in BlackX payloads matches a PDB path seen in an ESET report on the related FishMonger actor, the use of DLL sideloading paired with an encrypted payload file is common among Chinese-speaking threat actors, and the OxiDLLRunner payload uses OLLVM obfuscation, also typical of Chinese-speaking groups. Threat intel analysts tracking APT41 activity can follow attribution research like this on daily.dev."}}]} ```