Vulnerabilities & Exploits · APT / Espionage

APT41's BlackX bootkit keeps Baton Drop in play

Kaspersky GReAT identified BlackX, a BlackLotus-like UEFI bootkit, in an early-2026 APT41 campaign targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan.

After gaining administrator privileges, attackers use Baton Drop (CVE-2022-21894) to install BlackX in the UEFI boot path. It can run before the operating system loads, so ordinary OS cleanup may leave the foothold in place. Patching the vulnerability closes the installation route but cannot establish whether an earlier compromise altered the boot path.

For diplomatic organizations in Central Asia, an administrator-level intrusion may extend below the operating system; cleanup confined to the OS leaves the UEFI boot path's status unresolved.

1 source · 7h ago

Timeline

• Oct 22 Reported by Kaspersky Securelist

Sources

• Oct 22 Kaspersky Securelist

  New BlackX UEFI bootkit exploiting Baton Drop

  It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

  original

Part of the PlainSec briefing for 2026-10-22

Every edition of this story: APT41's BlackX bootkit keeps Baton Drop in play

More from today

• PHP patches land as attackers test runtime flaws
• GitLab's new release adds another unauthenticated code-execution flaw
• Qilin and INC carry Palo Alto VPN access into hypervisors