BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot in Central Asian diplomatic targets
A UEFI bootkit called BlackX, observed in early 2026, leveraged the Baton Drop vulnerability to bypass Secure Boot and load a malicious driver that interferes with Kaspersky and Avast security solutions. The campaign targeted diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and is attributed to the China-linked APT41 group.
Why it matters: It demonstrates that even patched Windows systems can be compromised via firmware attacks, highlighting the need for robust supply‑chain and firmware security measures.
Read the coverage
More in Security
Security20h ago2 sources