How does BlackX exploit the Baton Drop vulnerability to bypass Secure Boot?

The BlackX bootkit uses the Baton Drop vulnerability (CVE-2022-21894) to execute unsigned code at startup, even before the operating system loads its security mechanisms. According to BleepingComputer, this flaw allows BlackX to install custom Machine Owner Keys (MOK), thus manipulating the Secure Boot trust chain. The bootkit then loads a malicious driver signed with a revoked certificate (that of 温江区明宇网络技术服务工作室), which disables security calls related to Kaspersky and Avast products.

Microsoft released patches as early as 2023 to revoke the ‘Windows Production PCA 2011’ certificate, but their full deployment requires manual activation by administrators. As SecureList points out, this critical step was neglected in the targeted environments, leaving systems exposed despite their updates. BlackX operates in pre-OS mode, making it particularly resistant to incident response (IR) protocols, as explained by the team at Security Arsenal.

BlackX operates in pre-OS mode, making it particularly resistant to traditional incident response protocols.

What are the targets and evasion techniques used by BlackX?

BlackX was deployed in a spying campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan as early as the beginning of 2026, according to BleepingComputer. The attack is attributed with medium confidence to APT41, a group active for years and known by the names Brass Typhoon or Wicked Panda. Once installed, BlackX disables detection mechanisms for Kaspersky and Avast solutions by blocking the loading of their drivers or corrupting their system calls.

The bootkit uses a redirection technique: when a process attempts to access its files, it is redirected to the Windows calculator, a trick to evade analysis. Additionally, BlackX deploys a remote access Trojan (RAT) that communicates via cloud services like Google Drive, OneDrive, or Yandex.Disk to execute .NET payloads, as detailed by researchers from Kaspersky. This RAT interprets commands based on hexadecimal suffixes (0X01 to 0X05) to perform specific actions.

Why does BlackX evade Microsoft patches and security solutions?

BlackX exploits a flaw known since 2022 (Baton Drop), but its effectiveness relies on an operational gap: Microsoft designed the patch to revoke the vulnerable certificate as a supplementary measure, not an automatic one. As The420.in indicates, administrators must manually activate this revocation through UEFI blocklists (dbx). However, in the targeted environments, this step has been omitted, allowing BlackX to thrive even on up-to-date systems.

Furthermore, BlackX specifically targets Kaspersky and Avast products by disabling critical components, such as registry calls or tracing mechanisms (ETW). According to Security Arsenal, this approach reflects a classic technique used by espionage groups: neutralizing endpoint detection and response (EDR) solutions to prolong malicious presence. The bootkit also employs advanced obfuscation techniques, such as OxiDLLRunner (a malicious DLL sideloaded via googleupdate.exe) and Rust-based payloads, to evade traditional analysis.

What this means here: risks for Beninese and West African organizations

While BlackX has targeted diplomatic agencies in Central Asia, its modus operandi reveals exploitable vulnerabilities in other regions, including West Africa. Organizations relying on solutions like Kaspersky or Avast could face similar attacks if their systems exhibit the same gaps: lack of manual activation of UEFI revocations or suboptimal Secure Boot configurations. For example, administrations or businesses using centrally unmanaged workstations may see their security mechanisms bypassed by bootkits like BlackX.

Additionally, the use of legitimate cloud services (Google Drive, OneDrive) for command and control (C2) demonstrates that attackers are leveraging already authorized infrastructure. Beninese or West African organizations using these platforms for professional exchanges should monitor suspicious activities, such as files with unusual hexadecimal suffixes. Finally, BlackX’s pre-OS persistence underscores the importance for local CIOs to regularly verify the integrity of their EFI partition and apply Microsoft-recommended UEFI revocations, even after updates.