BlackX UEFI Bootkit Revives Baton Drop on Patched Windows Hosts That Skipped DBX Revocation

A suspected Chinese state group is defeating Secure Boot on Windows machines that pass patch compliance checks. Kaspersky has published research on BlackX, a UEFI bootkit used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan. Kaspersky suspects APT41. BlackX exploits CVE-2022-21894, the Baton Drop flaw that the BlackLotus bootkit made famous in 2023. Microsoft patched that bug years ago, but the patch on its own does not close it.

Fully fixing Baton Drop takes manual steps on top of the update. The key one is adding the "Windows Production PCA 2011" certificate to the Secure Boot Forbidden Signature Database (DBX). Kaspersky found that the attackers were relying on organizations skipping that step. The certificate expired on October 19, 2026, four days before this report. Expiry does not block the vulnerable boot binaries signed under it. Only a DBX entry does.

Why the Update Is Not the Fix

CVE-2022-21894 has a CVSS score of 4.4. Exploiting it requires administrator privileges or physical access. When BlackLotus surfaced, Microsoft called it "primarily a persistence and defense evasion mechanism" and said it was not an initial access vector. Many teams read a low score, a post-exploitation requirement and an installed update as a closed issue. Because the revocation step was separate and manual, it was easy to leave undone.

Kaspersky researchers Georgy Kucherin, Vladimir Nestor and Vasily Berdnikov said the actor "took into account that few organizations realized the importance of manually activating the Baton Drop patch" and chose to invest in rebuilding BlackLotus rather than developing a new exploit.

The Infection Chain

Kaspersky did not identify how the attackers got in. Once they had administrator rights on a target, they dropped two files and ran the installer from the command line.

• inst.exe: the installer, run as C:\ProgramData\Intel\inst.exe PVMDIJGKAX2 Q46F6MDLI3RX2KV1
• PVMDIJGKAX2: an encrypted file with no extension that holds the files and strings the installer needs
• Q46F6MDLI3RX2KV1: the RC4 key used to decrypt that file
• The installer writes files to both the system partition and the UEFI partition, then exploits CVE-2022-21894 in a way Kaspersky calls "remarkably similar" to BlackLotus
• The goal is to enroll attacker-controlled Machine Owner Keys (MOK), which lets the attacker load any EFI binary and undermines Secure Boot

The UEFI payload then injects a malicious driver into the Windows kernel. The driver was signed with a certificate issued to Wenjiang District Mingyu Network Technology Service Studio, which the issuer has since revoked. Like a bring-your-own-vulnerable-driver (BYOVD) attack, the driver tries to interfere with installed endpoint security software. Some of its tampering routines run only when Kaspersky or Avast products are present. Kaspersky's analysis found those routines do not work.

Two Espionage Payloads

The driver also drops a user-mode payload for espionage. Kaspersky observed two variants.

• A remote access trojan that can load more .NET payloads, collect system information and upload files of interest. It uses Google Drive, OneDrive and Yandex.Disk for command and control, so its traffic looks like normal enterprise cloud storage use.
• OxiDLLRunner, a malicious DLL sideloaded by a legitimate googleupdate.exe that the bootkit also delivers. It decrypts and runs a Rust payload that contacts archivetj[.]com to fetch and run more DLL plugins.

The cloud-storage C2 is the bigger detection problem. Blocking traffic to Google Drive or OneDrive is not realistic for most organizations. Spotting this RAT therefore depends on knowing which process is talking to those services, not on the destination.

An APT Rebuilding Crimeware

The BlackLotus source code has never been released publicly. That leaves two possibilities: the BlackX operators reverse-engineered the original bootkit, or they bought its source from someone else. Kaspersky noted that "we rarely see APT actors borrow ideas or code from cybercrime actors." BlackLotus was first advertised on criminal forums in late 2022, and ESET confirmed it in March 2023. More than three years later, a state-linked actor has turned the same technique into an espionage platform.

The APT41 Connection

The attribution draws on an ESET report from June 2026. That report covered FishMonger's use of the SprySOCKS Windows backdoor against government entities in Honduras, Taiwan, Thailand and Pakistan from 2023 to 2024. FishMonger, also tracked as Aquatic Panda and Earth Lusca, is assessed to operate under the APT41 umbrella. ESET found "limited indications" that some SprySOCKS versions include a UEFI bootkit component that likely exploits CVE-2023-24932, another BlackLotus-linked Secure Boot bypass. BlackX and the FishMonger kernel implant also share an "xdd" string. The attribution is still a suspicion, not a confirmed finding.

RedEye Assessment

BlackX is a gap in remediation, not a new vulnerability. The vendor fix for CVE-2022-21894 has existed since 2022, and Microsoft's revocation guidance spells out the remaining step. The exposure comes from treating an installed update as the end of the job. Patch dashboards cannot see DBX contents, so they report these hosts as compliant.

Removing BlackX is also harder than removing ordinary malware. It runs before the operating system, enrolls its own keys and loads a kernel driver built to interfere with security tools. An EDR alert on the user-mode RAT does not show that the firmware is clean. Organizations in government, diplomacy and other sectors APT41 targets should assume this technique will spread beyond Central Asia. They should treat Secure Boot revocation status as a security control to verify, not a box ticked when the update was installed.