Secure UEFI Firmware to Stop BlackX Bootkit from Bypassing Secure Boot

Kaspersky Securelist researchers discovered a new UEFI bootkit named BlackX being used against diplomatic organizations in Central Asia during early 2026. This campaign targeted agencies in Tajikistan, Uzbekistan, and Turkmenistan, marking a revival of techniques previously seen in the BlackLotus malware.

The attackers achieved persistence by exploiting the Baton Drop vulnerability, known as CVE-2022-21894. This flaw allows malicious actors to bypass Secure Boot protections. By installing custom Machine Owner Keys, the threat group could load arbitrary EFI files onto the target machines, effectively undermining the integrity of the boot process.

Attack Methodology

The intrusion began after the attackers compromised victim networks and obtained administrator privileges. They deployed an installer that dropped encrypted files to both system and UEFI partitions. The installer package contained all necessary components within a single RC4-encrypted file, making it difficult for incident responders to retrieve individual bootkit parts.

The implementation of the exploit was remarkably similar to that of BlackLotus. However, the source code for BlackLotus has never been published. This suggests the attackers behind BlackX either reverse-engineered the original bootkit or purchased its source code from cybercriminals, an unusual move for APT actors.

Affected Systems and Payloads

The UEFI payload injected a malicious driver into the Windows kernel. This driver was signed with a certificate belonging to Wenjiang District Mingyu Network Technology Service Studio. At the time of the report, the issuer had revoked this specific certificate, which bears serial number 0bcdf5e0da32d68900b8b7638459d072.

The primary goal of the driver was to tamper with installed security solutions. It disabled process, thread, and registry callbacks related to security software. Additionally, it interfered with Event Tracing for Windows providers, preventing security tools from accessing their output and obscuring the attacker's activities.

What to watch

Microsoft released multiple security updates to address the Baton Drop vulnerability after ESET confirmed the exploit's viability in March 2023. Organizations should verify that their systems are patched against CVE-2022-21894. Monitoring for unauthorized Machine Owner Keys or unusual UEFI modifications is also critical for detecting similar bootkit infections.

What made it possible

Bootkits exploit the trust placed in firmware initialization routines before the operating system loads. Attackers target vulnerabilities in the UEFI stack to bypass security features like Secure Boot. This technique serves the persistence stage of an intrusion, allowing malicious code to survive system reinstalls. Teams usually monitor for unexpected changes to firmware settings or unauthorized digital signatures in the boot chain to detect such low-level compromises early.

Background: Malware

Malware targets small businesses because they lack layered defenses. You must isolate sensitive data, restrict software execution, and verify IT provider backup integrity. Focus on reducing the attack surface through strict access controls and regular, offline data restoration tests.

Read the full guide: Malware Defense: Practical Steps for Small Business Security

What to do and how to stay safe: Kaspersky

• Ensure all systems are updated with the latest patches for CVE-2022-21894 to close the Baton Drop vulnerability.
• Audit UEFI firmware settings regularly to detect unauthorized Machine Owner Keys or disabled Secure Boot features.
• Monitor for anomalous kernel drivers, especially those with revoked or suspicious digital certificates, in your environment.
• Review Event Tracing for Windows logs for signs of tampering or disabled providers that could indicate hidden malware activity.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which countries were targeted by the BlackX bootkit campaign?

The campaign targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan, according to Kaspersky researchers.

What vulnerability does BlackX exploit to bypass Secure Boot?

It exploits the Baton Drop vulnerability, identified as CVE-2022-21894, to install custom Machine Owner Keys.

How does the BlackX driver evade security solutions?

The driver disables process, thread, and registry callbacks and tampers with Event Tracing for Windows providers to hide its presence.