Firmware Exploitation: BlackX Bootkit Leverages Persistent Baton Drop Vulnerability for Covert Espionage Operations

A sophisticated new UEFI bootkit, identified as BlackX, has been deployed in a targeted espionage campaign, exploiting a known vulnerability to circumvent critical system defenses and establish deep-seated persistence on compromised machines. This advanced malware, active since early 2026, exploits the long-standing Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot, enabling the installation of a malicious kernel-mode driver engineered specifically to disrupt leading endpoint security solutions and facilitate covert data exfiltration.

The BlackX campaign has been attributed with a medium level of confidence to APT41, a prominent Chinese state-sponsored threat group recognized by various monikers including Brass Typhoon, Wicked Panda, and Barium. This attribution underscores the strategic importance and advanced capabilities behind the operation. Discovered in the initial months of 2026, the primary targets of this campaign were diplomatic entities situated in Central Asia, specifically within the nations of Tajikistan, Uzbekistan, and Turkmenistan, indicating a clear geopolitical intelligence gathering objective.

Understanding the UEFI Secure Boot Bypass and Baton Drop

To fully appreciate the significance of BlackX, it is crucial to understand the foundational role of UEFI (Unified Extensible Firmware Interface) and its security feature, Secure Boot. UEFI is the software interface between an operating system and platform firmware, replacing the older BIOS system. Secure Boot is a critical security protocol within UEFI designed to prevent the loading of unsigned or unauthorized code during the boot process. It ensures that only trusted software, signed with cryptographic keys recognized by the system’s firmware, can execute, thereby protecting against rootkits and bootkits that attempt to compromise the operating system before it even starts.

The Baton Drop vulnerability, identified as CVE-2022-21894, represents a critical flaw in this security chain. It specifically affects certain vulnerable versions of Windows boot managers signed with a legitimate Microsoft certificate, "Windows Production PCA 2011." This vulnerability allows an attacker to load an unsigned, malicious boot policy, effectively circumventing Secure Boot’s protection mechanism. By manipulating the Machine Owner Keys (MOKs) and leveraging this flaw, threat actors can introduce their own unsigned EFI (Extensible Firmware Interface) files, thereby gaining control at the earliest stages of system startup, before the operating system or any traditional security software has a chance to load. This level of access is highly prized by advanced persistent threat (APT) groups due to its stealth, persistence, and ability to subvert higher-level security controls.

The Genesis of BlackX: A Kinship with BlackLotus

Researchers at Kaspersky, who spearheaded the analysis of BlackX, noted striking similarities between this new bootkit and BlackLotus. BlackLotus is another notorious UEFI bootkit that gained infamy for its circulation on underground hacker forums since late 2022 and its pioneering use of the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot. ESET had previously confirmed in March 2023 that BlackLotus could compromise even fully patched Windows 11 systems, highlighting the severity and persistence of the underlying flaw.

The implementation of the Baton Drop exploit within BlackX is described as "remarkably similar" to that observed in BlackLotus. Both bootkits leverage the same fundamental technique to enroll custom Machine Owner Keys (MOKs) and subsequently load arbitrary EFI files, effectively neutralizing Secure Boot protections. This deep architectural resemblance suggests a direct lineage or a profound understanding of BlackLotus’s mechanics by the BlackX developers.

However, BlackX diverges from BlackLotus in its subsequent stages, deploying a distinct kernel driver and follow-on espionage payloads. This differentiation leads to two primary hypotheses regarding BlackX’s origin: either it was developed through meticulous reverse-engineering of existing BlackLotus samples, or its creators managed to acquire the full or partial source code of BlackLotus.

The latter theory gains credence from the context of the BlackLotus source code leak in July 2023. While a version of BlackLotus’s source code was indeed made public on platforms like GitHub, investigations revealed that this release was incomplete, lacking certain critical components. Kaspersky researchers discovered that some BlackLotus samples they analyzed contained code segments that were absent from the publicly leaked repository but conspicuously present within the BlackX bootkit. This observation strongly suggests that the operators behind BlackX possessed access to a more comprehensive version of BlackLotus’s internal workings than what was publicly available, lending weight to the possibility of a direct acquisition of the source code or an exceptionally thorough reverse-engineering effort that transcended the limitations of the public leak.

BlackX Capabilities: A Multi-layered Attack

Once deployed, BlackX establishes a formidable presence on the compromised system through a sophisticated malicious Windows kernel driver. This driver is signed with a digital certificate that was initially issued to an entity named "Wenjiang District Mingyu Network Technology Service Studio," a certificate that has since been revoked. The use of a signed driver, even if subsequently revoked, highlights the attacker’s initial efforts to maintain legitimacy and evade early detection.

The capabilities of this kernel driver are extensive and designed for deep system interference and evasion:

1. Security Solution Disruption: The driver is programmed to disable security-related processes and tamper with registry callbacks that are crucial for monitoring system integrity and security events. A particularly targeted feature is its interference with Event Tracing for Windows (ETW) providers, a vital component for system monitoring and incident response. Notably, some of these tampering procedures are conditionally executed only if the presence of Kaspersky or Avast security products is detected on the target host, indicating a specific focus on neutralizing these widely used solutions. While the researchers assert this mechanism is ineffective against their own solutions, it underscores the adversary’s intent to specifically target and bypass popular security vendors.

2. Bootkit File Protection: To ensure its persistence and resist removal, the driver implements a novel file protection mechanism. When a user or system process attempts to open or access files associated with the bootkit, the malicious driver intercepts these requests and, instead of allowing access, launches the Windows Calculator application. This deceptive maneuver prevents direct inspection or deletion of the bootkit’s components, making remediation significantly more challenging.

3. Espionage Payload Deployment: The primary purpose of establishing such deep-rooted access is to facilitate espionage. The kernel driver is responsible for deploying and managing follow-on espionage payloads on infected machines. While specific details of these payloads were not fully enumerated in the provided information, typical espionage payloads deployed by APT groups with such initial access capabilities commonly include:

   • Information Stealers: Designed to exfiltrate sensitive documents, emails, browser histories, and other data of intelligence value.
   • Credential Harvesters: Tools to collect usernames, passwords, and other authentication tokens from local systems and network services.
   • Keyloggers: To capture keystrokes, providing insights into user activities and potentially revealing sensitive information.
   • Screen Capture Utilities: To periodically take screenshots of the user’s desktop, capturing visual context of their activities.
   • Remote Access Trojans (RATs) / Backdoors: To establish persistent command-and-control communication, allowing the attackers to maintain long-term access, execute arbitrary commands, and exfiltrate data.
   • Network Reconnaissance Tools: To map the internal network, identify other potential targets, and prepare for lateral movement.

The Critical "Insufficient Fix" Paradox

A particularly alarming aspect of the BlackX campaign is its success against fully patched Windows systems. The bootkit’s efficacy highlights a critical gap in the update process for the Baton Drop vulnerability (CVE-2022-21894). The patch designed to address this flaw specifically aims to revoke the "Windows Production PCA 2011" certificate, which was used to sign the vulnerable UEFI components. However, this revocation is not automatically triggered upon patch installation. Instead, it requires explicit manual intervention from the administrator to activate these additional Secure Boot revocations.

This manual step represents a significant vulnerability in the security update process. In most enterprise environments, administrators rely heavily on automated patching mechanisms, assuming that once an update is applied, the system is fully protected. The expectation that an administrator would take an uncommon, manual action after applying a security update is generally unrealistic. This oversight creates a window of opportunity that sophisticated threat actors, such as those behind BlackX, are adept at exploiting.

The Kaspersky researchers explicitly state that the attackers leveraged this mitigation gap to their advantage, investing time and resources into understanding BlackLotus’s functionality and subsequently developing BlackX as a copycat bootkit tailored to exploit this administrative blind spot. Furthermore, they emphasize that the expiration date of October 19, 2026, for the "Windows Production PCA 2011" certificate does not inherently prevent vulnerable binaries from loading on Windows systems. Unless administrators proactively add this certificate to a blocklist (or "dbx" in UEFI terms), the vulnerability remains exploitable, underscoring the enduring nature of this threat despite the passage of time. Microsoft has provided detailed instructions for fully patching Baton Drop (CVE-2022-21894) for those seeking to implement the necessary manual revocations.

Broader Implications and Future Outlook

The BlackX campaign serves as a stark reminder of the escalating sophistication of state-sponsored cyber espionage and the persistent threat posed by UEFI bootkits. The ability to compromise systems at the firmware level grants adversaries unparalleled stealth, persistence, and the means to bypass virtually all operating system-level security controls. This makes detection and remediation exceptionally difficult, often requiring specialized tools and techniques for firmware analysis and re-flashing.

The geopolitical targeting of diplomatic agencies in Central Asia is consistent with APT41’s known objectives of intelligence gathering, reflecting the strategic importance of the region. Such attacks aim to acquire sensitive information, disrupt diplomatic communications, or gain insights into regional policies and alliances.

For organizations, the BlackX incident underscores several critical lessons:

• Comprehensive Patch Management: Patching must extend beyond automated updates to include a thorough understanding of mitigation steps that may require manual intervention, especially for critical firmware-level vulnerabilities.
• UEFI Integrity Monitoring: Implementing solutions capable of monitoring UEFI firmware integrity and detecting unauthorized modifications is paramount. This includes regular verification of Secure Boot configurations and enrolled keys.
• Hardware-Level Security: Leveraging hardware-based security features, such as Intel Boot Guard or AMD Secure Processor, can provide additional layers of protection against firmware tampering.
• Advanced Threat Detection: Traditional endpoint security solutions, while important, may be insufficient against bootkits. Advanced Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) platforms with visibility into the boot process and firmware can offer better detection capabilities.
• Threat Intelligence Integration: Staying abreast of the latest threat intelligence, particularly regarding state-sponsored actors and their evolving tactics, techniques, and procedures (TTPs), is crucial for proactive defense.
• Security Awareness and Training: While administrators are the primary target for manual revocation steps, a general awareness of firmware threats can contribute to a stronger overall security posture.

The evolution of bootkits like BlackX and BlackLotus signifies a deepening shift in the cyber conflict landscape, where adversaries are increasingly targeting the lowest levels of the computing stack to achieve maximum impact and stealth. As security measures at the operating system and application layers become more robust, the firmware layer will likely remain a highly contested battleground, necessitating continuous innovation in defensive strategies and a vigilant approach to system integrity from power-on. The cat-and-mouse game between attackers and defenders at this foundational level is set to intensify, making firmware security a paramount concern for national security and critical infrastructure.