New BlackX UEFI bootkit exploiting Baton Drop
In early 2026, a sophisticated APT campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan deployed BlackX, a UEFI bootkit similar to the notorious BlackLotus. The bootkit exploits the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and install malicious drivers into the Windows kernel. Despite patches being available since 2023, victims remained vulnerable because the mitigation requires manual activation by administrators. The campaign deploys cyberespionage payloads including a RAT using cloud storage for command and control, and OxiDLLRunner, a Rust-based payload. The attack demonstrates APT actors borrowing techniques from cybercrime operations, as BlackX appears to be reverse-engineered from BlackLotus code. Attribution points to APT41 based on code similarities and tactics matching previous campaigns.
Pulse ID: 6ad9df071ab39972490f947b
Pulse Link: https://otx.alienvault.com/pulse/6ad9df071ab39972490f947b
Pulse Author: AlienVault
Created: 2026-10-22 10:01:43
Be advised, this data is unverified and should be considered preliminary. Always do further verification.