BlackX UEFI bootkit uses Baton Drop to slip past patched Windows PCs

On 24 October 2026, Bleeping Computer reported on an analysis by Kaspersky researchers of a new UEFI bootkit called BlackX. It was deployed in early 2026 against diplomatic agencies in Central Asia, including in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky attributes it with medium confidence to APT41, a Chinese state-backed group that also goes by Brass Typhoon, Wicked Panda and Barium. That’s a lot of names for one group. The attribution and every technical detail below come from a single source: Kaspersky’s report, as relayed by Bleeping Computer.

A flaw BlackLotus already took for a spin

BlackX exploits CVE-2022-21894, better known as Baton Drop. The flaw has already been used by BlackLotus, a bootkit that has been on sale on hacker forums since October 2022. In March 2023, ESET confirmed that BlackLotus exploited it and could, at the time, compromise fully updated Windows 11 systems.

According to Kaspersky, BlackX implements the exploit almost exactly the way BlackLotus does. It lets the attacker enrol Machine Owner Keys (MOK) of their choosing and load arbitrary EFI files. In practice, Secure Boot still looks like it’s on while doing nothing at all. The researchers don’t think this is a straight copy-paste of the BlackLotus source code leaked in July 2023, though. That leak was incomplete, and some BlackLotus samples contain code that’s missing from the public repository but present in BlackX. So the attacker either reverse-engineered BlackLotus or bought its source code. Where BlackX goes its own way is in its kernel driver and its payloads.

A driver built to blindfold the defences

Once Secure Boot is out of the way, BlackX injects a Windows kernel driver. It’s signed with a now-revoked certificate issued to an organisation called Wenjiang District Mingyu Network Technology Service Studio. The driver disables security-related processes and registry callbacks, and tampers with Event Tracing for Windows (ETW) providers to get in the way of monitoring. Some of these tricks only kick in if a Kaspersky or Avast product is detected on the machine. Kaspersky says they have no effect on its own products. The driver also guards the bootkit’s files: try to open one and Windows Calculator pops up instead. It’s not much of a defence, but you have to admire the comic timing.

Finally, the driver installs the spying tools. The first is a remote access trojan that uses Google Drive, OneDrive or Yandex.Disk as its command channel, runs .NET payloads and transfers files. The second is OxiDLLRunner, an obfuscated DLL loaded by googleupdate.exe. It runs shellcode, then a payload written in Rust that fetches and runs plugins.

Why an installed patch isn’t enough

According to Kaspersky, every victim was running a fully up-to-date version of Windows. The Baton Drop fix is supposed to revoke the “Windows Production PCA 2011” certificate, which was used to sign the vulnerable UEFI components. The catch is that installing the update doesn’t trigger that revocation. You have to switch it on yourself.

Until you do, Secure Boot keeps accepting components signed with that certificate, including the ones that contain the flaw. The machine is patched on paper, but the chain of trust that lets the vulnerable code in is still there. It’s like changing the locks and leaving the old key under the doormat. Kaspersky calls this a gap in the update process, since admins almost never take a manual step after a security patch. According to the researchers, that gap is exactly what convinced the attacker it was worth spending time studying BlackLotus to build a copy.

The certificate’s expiry won’t save you

The “Windows Production PCA 2011” certificate expired on 19 October 2026. The researchers warn that this doesn’t stop vulnerable binaries from loading on Windows systems unless admins add the certificate to a blocklist. The Bleeping Computer article links to instructions for fully fixing Baton Drop. If you run a fleet of Windows machines, checking that those steps have been applied is the only way to know whether the patch you installed is actually protecting you.

The victims had done their homework and installed the update. Nobody had told them about the second page.