In early 2026, researchers identified a new UEFI bootkit, dubbed BlackX, that exploits the Baton Drop vulnerability (CVE-2022-21894) in a targeted APT campaign against diplomatic agencies in Central Asia. This discovery, reported by Kaspersky’s GReAT team, highlights the evolving threat landscape where sophisticated malware can bypass Secure Boot protections, raising significant concerns for cybersecurity professionals and organizations worldwide.
The Emergence of BlackX
The BlackX bootkit is reminiscent of the previously reported BlackLotus, which was first advertised on a hacking forum in October 2022. Initially met with skepticism due to the lack of samples, BlackLotus was later confirmed by ESET in March 2023 as a genuine threat capable of bypassing Secure Boot. The resurgence of similar capabilities in BlackX indicates a troubling trend in the reuse and adaptation of advanced malware techniques.
BlackX was deployed after attackers gained administrator privileges on victim networks, utilizing a two-file installation process. The primary executable, inst.exe, serves as a launcher for an encrypted file, PVMDIJGKAX2, which contains the necessary components for the bootkit installation. This method complicates incident response efforts, as the installer itself does not reveal any malicious strings, making detection more challenging.
Technical Mechanisms of Exploitation
The exploitation process mirrors that of BlackLotus, aiming to install custom Machine Owner Keys (MOK) that allow the loading of arbitrary EFI files. This manipulation of Secure Boot is particularly concerning, as it undermines a critical security feature designed to protect against unauthorized code execution during the boot process.
While the exploitation chain shares similarities with BlackLotus, there are notable differences, suggesting that the developers of BlackX may have either reverse-engineered the original bootkit or acquired its source code. This cross-pollination of techniques between APT actors and cybercriminals is rare, indicating a potential shift in the operational landscape.
Payload and Operational Impact
The payload delivered by BlackX is designed to inject a malicious driver into the Windows kernel, which is signed with a now-revoked certificate from a Chinese organization. This driver is engineered to disable security solutions and protect the bootkit’s files from detection and tampering. Notably, the driver includes specific routines targeting Kaspersky and Avast products, although these attempts were found ineffective during analysis.
In addition to kernel-level manipulation, BlackX deploys user-mode payloads for cyberespionage, including a Remote Access Trojan (RAT) that utilizes cloud storage for command and control communications. This RAT can execute further-stage payloads, demonstrating the bootkit’s capability to facilitate extensive and persistent access to compromised systems.
Attribution and Implications
Attribution of the BlackX campaign points towards the APT41 threat actor, based on several indicators, including patterns of behavior and the use of specific obfuscation techniques. The operational methods employed in this campaign reflect a high level of sophistication and planning, suggesting that the attackers are well-resourced and experienced.
Challenges in Patch Management
Despite the existence of patches for the Baton Drop vulnerability, the targeted organizations were fully updated, yet still fell victim to the attack. This was due to the manual steps required to revoke the vulnerable certificate, which many administrators may overlook. The complexity of patch management and the necessity for proactive measures are underscored by this incident, highlighting the need for organizations to adopt comprehensive security strategies that include robust monitoring and incident response capabilities.
As the cybersecurity landscape continues to evolve, the emergence of BlackX serves as a stark reminder of the persistent threats posed by advanced malware. Organizations must remain vigilant, ensuring that their defenses are not only up to date but also capable of addressing the sophisticated tactics employed by modern threat actors.
For further insights into the technical details of the BlackX bootkit and its implications, refer to the comprehensive analysis by Kaspersky’s GReAT team here.
