BlackX UEFI Bootkit Exploits Baton Drop Flaw to Bypass Secure Boot

Security researchers have uncovered a sophisticated UEFI bootkit named BlackX, deployed in an espionage campaign active in early 2026. The bootkit exploits the Baton Drop vulnerability to bypass Secure Boot mechanisms, allowing it to load a malicious driver during the boot process. This driver is specifically designed to interfere with security products from Kaspersky and Avast, disabling or undermining their protections. The attack leverages the UEFI firmware layer to achieve persistence that is difficult to detect and remove. The campaign's focus on security solution interference suggests objectives involving data exfiltration or long-term access. As of the report, no specific CVE or patch has been identified for the Baton Drop flaw, and mitigation relies on updating UEFI firmware to the latest vendor-signed versions and maintaining Secure Boot enabled. The attribution to espionage actors aligns with broader industry trends in firmware-level threats.