{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation · updates",
  "home_page_url": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass",
  "feed_url": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass/feed.json",
  "description": "Kaspersky GReAT found a new UEFI bootkit, BlackX, used in early 2026 against diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and attributed with medium confidence to China-linked APT41. It is a copycat of BlackLotus and exploits Baton Drop (CVE-2022-21894) to install its own Machine Owner Keys, load arbitrary EFI files and inject a kernel driver that blinds security software. The targeted machines were fully patched: Microsoft's fix only revokes the vulnerable \"Windows Production PCA 2011\" signing certificate after an admin manually sets a registry flag under HKLM\\SYSTEM\\CurrentControlSet\\Control\\Secureboot and runs the Secure-Boot-Update task, and Microsoft's planned automatic enforcement phase has not shipped. The certificate expired on Oct 19, 2026, but that does not stop vulnerable boot binaries from loading unless it is in the DBX blocklist. Attackers need admin rights or physical access first, so this is a persistence tool, not an initial access vector. Windows admins should apply Microsoft's Secure Boot revocation steps manually.",
  "language": "en",
  "_pwn": {
    "slug": "blackx-uefi-bootkit-baton-drop-secure-boot-bypass",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass/feed.xml",
    "llms": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass/llms.txt",
    "json": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass#2026-10-23-c8943375",
      "url": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass#2026-10-23-c8943375",
      "title": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation: The Hacker News reports the campaign and the manual revocation gap.",
      "content_text": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation: The Hacker News reports the campaign and the manual revocation gap.\n\nSource: https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html",
      "date_published": "2026-10-23T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/10/blackx-uefi-bootkit-bypasses-secure.html",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass#2026-10-22-3cb8fe05",
      "url": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass#2026-10-22-3cb8fe05",
      "title": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation: Kaspersky GReAT publishes its BlackX report: Baton Drop exploited on fully patched machines at Central Asian diplomatic organizations, likely APT41.",
      "content_text": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation: Kaspersky GReAT publishes its BlackX report: Baton Drop exploited on fully patched machines at Central Asian diplomatic organizations, likely APT41.\n\nSource: https://securelist.com/uefi-bootkit-blackx/121539/",
      "date_published": "2026-10-22T00:00:00.000Z",
      "external_url": "https://securelist.com/uefi-bootkit-blackx/121539/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass#2026-10-19-95ea1609",
      "url": "https://pwn.watch/i/blackx-uefi-bootkit-baton-drop-secure-boot-bypass#2026-10-19-95ea1609",
      "title": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation: The \"Windows Production PCA 2011\" certificate expires; Kaspersky notes this does not stop vulnerable binaries from loading unless it is blocklisted.",
      "content_text": "BlackX UEFI bootkit bypasses Secure Boot on patched Windows machines that never applied the Baton Drop revocation: The \"Windows Production PCA 2011\" certificate expires; Kaspersky notes this does not stop vulnerable binaries from loading unless it is blocklisted.\n\nSource: https://securelist.com/uefi-bootkit-blackx/121539/",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://securelist.com/uefi-bootkit-blackx/121539/",
      "tags": [
        "high"
      ]
    }
  ]
}