BlackX, a UEFI bootkit that Kaspersky found in an espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, ran on Windows machines that already carried the patch for Baton Drop (CVE-2022-21894). Kaspersky attributes the campaign to APT41 with medium confidence. The attackers deployed BlackX after breaking into victims' networks and obtaining administrator privileges.
Patch status was not the weak point; the patch design was. Per Kaspersky, installing the Baton Drop update does not revoke the Windows Production PCA 2011 certificate that signs the vulnerable UEFI components. An administrator has to set a registry flag under the Secureboot key and run the Secure-Boot-Update scheduled task, steps Kaspersky says are buried deep on Microsoft's website. Kaspersky gives dual-boot systems that rely on the old certificate as one example of what an automatic revocation could break.
Microsoft, in its guidance for CVE-2023-24932, the related Secure Boot bypass that BlackLotus used, says the mitigations are off by default and that once applied they cannot be undone while Secure Boot stays in use, even by reformatting the disk. Its rollout plan includes an enforcement phase that would revoke the certificate without user action. Kaspersky says that phase has not been implemented; Microsoft has not set its date and says it will give at least six months' warning before it begins. The certificate expired on October 19, 2026, but expiry alone does not keep vulnerable binaries from loading unless the certificate is blocklisted.
BlackX closely follows BlackLotus, the bootkit ESET confirmed in March 2023 after a $5,000 forum advertisement. Both exploit Baton Drop to install custom Machine Owner Keys, which lets attackers load arbitrary EFI files and manipulate Secure Boot, though Kaspersky found differences between the two exploit chains. The BlackLotus source code was never published, so Kaspersky suggests the BlackX authors either reverse-engineered BlackLotus or bought its source code from cybercriminals. Kaspersky notes that it rarely sees APT actors borrow ideas or code from cybercrime groups.
The dropper, inst.exe, holds no malicious strings or embedded blobs. Every file the bootkit needs sits inside an RC4-encrypted companion file, so responders have a harder time pulling the components out. Once running, BlackX loads a kernel driver signed with a certificate belonging to an organization named Wenjiang District Mingyu Network Technology Service Studio, which the issuer has since revoked. The driver switches off the process, thread and registry callbacks that security products rely on, interferes with their ETW output, and intercepts kernel requests to open the bootkit's files, returning a handle to calc.exe instead. Some of its tampering routines run only when Kaspersky or Avast software is present, but Kaspersky says they fail against its products.
The driver also deploys a user-mode espionage payload, and Kaspersky observed two of them in the wild. One is a RAT that loads further .NET modules and takes its commands from files in Google Drive, OneDrive or Yandex.Disk. The other, a loader Kaspersky named OxiDLLRunner, runs a Rust payload that contacts a command server at www[.]archivetj[.]com. For attribution, Kaspersky points to an identifier, "xdd", that appears in the BlackX payloads and in a PDB path from a June 2026 ESET report on the FishMonger group, which the community assumes is related to APT41.
