BlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Boot

What happened

According to BleepingComputer, researchers identified a new UEFI bootkit dubbed BlackX, deployed in an espionage campaign observed in early 2026. The bootkit reportedly exploits the previously disclosed Baton Drop vulnerability to bypass UEFI Secure Boot and load a malicious driver. That driver is designed to interfere with security software from Kaspersky and Avast. Technical specifics beyond this summary (targeted sectors, delivery mechanism, full payload capabilities) have not yet been detailed in the reporting available at publication time.

Why it matters

UEFI bootkits execute before the operating system and most endpoint security agents load, giving them a durable foothold that survives OS reinstalls and is difficult to detect with conventional host-based tooling. Abusing a Secure Boot bypass to load a kernel-mode driver aimed at disabling or blinding AV/EDR products is a classic pre-positioning move in espionage operations — it's intended to let follow-on tooling operate undetected. Any organization relying on Kaspersky or Avast as a primary detection layer, or any environment with UEFI Secure Boot misconfigured or using outdated revocation lists, should treat this as directly relevant.

What defenders should watch for now

• Verify UEFI Secure Boot is enabled and that DBX (revocation) lists are current on endpoints, since Baton Drop-style bypasses typically rely on signed-but-vulnerable bootloaders that should eventually be revoked.
• Hunt for unexpected or unsigned drivers loading at boot, and for security-product services unexpectedly stopping, crashing, or failing to report telemetry — a common signal of AV/EDR tampering.
• Review firmware/boot integrity where available (TPM measured boot logs, UEFI firmware attestation) for anomalies rather than relying solely on OS-level logging, since this threat operates below that layer.
• Ensure firmware and bootloader components are patched/updated per vendor guidance, as fixes for known Secure Boot bypass flaws are typically delivered via firmware and bootloader updates.
• If running Kaspersky or Avast, monitor vendor advisories for guidance specific to this bootkit and driver.

Developing story

This is net-new intelligence from a single source report, and details are still emerging — we have not independently verified the technical mechanics of the Secure Boot bypass or the full scope of the campaign. We'll update coverage as more information becomes available. Read the original report at BleepingComputer.