Vulnerabilities · 6h ago

APT41's BlackX bootkit keeps Baton Drop in play

Kaspersky GReAT identified BlackX, a BlackLotus-like UEFI bootkit, in an early-2026 APT41 campaign targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan.

After gaining administrator privileges, attackers use Baton Drop (CVE-2022-21894) to install BlackX in the UEFI boot path. It can run before the operating system loads, so ordinary OS cleanup may leave the foothold in place. Patching the vulnerability closes the installation route but cannot establish whether an earlier compromise altered the boot path.

For diplomatic organizations in Central Asia, an administrator-level intrusion may extend below the operating system; cleanup confined to the OS leaves the UEFI boot path's status unresolved.

CVE-2022-21894

NVD KEV

CVSS 4.4 MEDIUM: secure Boot Security Feature Bypass Vulnerability EPSS 7% (94th percentile).

Timeline

Oct 22 Reported by Kaspersky Securelist

Sources

1 source covering this story

Kaspersky Securelist Oct 22
New BlackX UEFI bootkit exploiting Baton Drop
It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

Entities

CVE-2022-21894
APT41

Part of the PlainSec briefing for 2026-10-22

Editions

Briefing for 2026-10-22

Vulnerabilities · 6h agoAPT41's BlackX bootkit keeps Baton Drop in playKaspersky GReAT identified BlackX, a BlackLotus-like UEFI bootkit, in an early-2026 APT41 campaign targeting diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan.After gaining administrator privileges, attackers use Baton Drop (CVE-2022-21894) to install BlackX in the UEFI boot path. It can run before the operating system loads, so ordinary OS cleanup may leave the foothold in place. Patching the vulnerability closes the installation route but cannot establish whether an earlier compromise altered the boot path.For diplomatic organizations in Central Asia, an administrator-level intrusion may extend below the operating system; cleanup confined to the OS leaves the UEFI boot path's status unresolved.