New BlackX Bootkit Bypasses Secure Boot via Old Flaw

BlackX Bootkit Found Bypassing Secure Boot Through Years-Old Flaw

A newly identified UEFI bootkit named BlackX is bypassing Secure Boot protections by exploiting Baton Drop, a Secure Boot vulnerability that has been publicly known since 2022, according to a security report published this week. The bootkit was reportedly deployed in an espionage campaign that researchers trace to early 2026, and it loads a malicious driver built to interfere with security software from Kaspersky and Avast, two widely used antivirus vendors, the report states.

Secure Boot is a firmware-level security standard, defined by the Unified Extensible Firmware Interface (UEFI) Forum, that checks the digital signature of a device's bootloader and operating system components before they load, blocking unsigned or tampered code from running at startup. A bootkit that defeats Secure Boot runs before the operating system and most endpoint security tools even start, which is why bootkit infections are difficult to detect with standard antivirus scans.

Attribution for the campaign has not been publicly disclosed in the available reporting, and the specific victims or targeted sectors were not named. Bootkits are typically associated with long-term espionage operations rather than opportunistic financial crime, because the effort required to build and deploy one only pays off when an attacker needs persistence that survives reinstalls, disk wipes, and most incident response procedures.

Why a 2022 Vulnerability Is Still Being Exploited in 2026

Baton Drop, tracked as CVE-2022-21894, is a vulnerability in Microsoft-signed UEFI bootloaders that was first exploited publicly by the BlackLotus bootkit in 2022 and 2023. Microsoft patched the underlying bootloader code, but revoking every vulnerable signed bootloader risked breaking boot processes on systems that had not yet installed the fix, so many of the older signed binaries were never fully blocked across the Windows ecosystem. That gap is what BlackX appears to be exploiting: a system can be fully patched against known Windows vulnerabilities and still boot a vulnerable, Microsoft-signed bootloader that an attacker uses as a stepping stone to load unsigned code ahead of Secure Boot checks.

This pattern, a known flaw with a fix that cannot be fully enforced without breaking compatibility for some users, is becoming a recurring weakness in firmware security. Attackers increasingly favor it because exploiting Secure Boot once can deliver persistence that survives operating system reinstalls and most remediation steps that do not touch firmware.

Microsoft has published guidance on migrating to a newer UEFI Certificate Authority, the Windows UEFI CA 2023, specifically to reduce reliance on the original 2011 certificate that still trusts many of the older, riskier bootloaders. That migration remains optional for most organizations today, which means the exposure BlackX relies on will persist on a large share of Windows devices until IT teams actively adopt the newer certificate chain and update their boot loader revocation lists.

What This Means for Small Businesses and Healthcare Practices

Most small business IT and managed service contracts focus on operating system patching, endpoint antivirus, and email security. Bootkits like BlackX operate below that layer, so a practice can be fully current on Windows updates and still carry a hidden infection at the firmware level. For healthcare practices and tax professionals handling regulated patient or financial data, a successful bootkit infection that disables or blinds antivirus tools, as BlackX is reported to attempt against Kaspersky and Avast products, can leave a breach undetected for an extended period, which complicates both incident response and breach notification timelines under frameworks such as HIPAA.

Because the specific targeting, affected hardware list, and distribution method for BlackX have not been detailed in the available reporting, organizations should treat this as a signal to verify firmware-level defenses rather than confirmation of an active threat against any particular industry.

Practical Steps to Reduce Bootkit Exposure

• Confirm Secure Boot is enabled and verify your organization's UEFI firmware revocation list (DBX) is current; Microsoft and OEM vendors periodically update these lists to block known-bad bootloaders.
• Apply firmware (UEFI/BIOS) updates from your device manufacturer, not just Windows updates. Baton Drop and similar bootloader issues are fixed through firmware and signature revocation, not standard OS patches alone.
• Use endpoint detection tools that specifically scan firmware and boot configuration, since antivirus running inside the operating system cannot see malicious code that loads before the OS starts.
• For high-value systems, evaluate Microsoft's Windows UEFI CA 2023 certificate transition, which blocks many older vulnerable bootloaders that the original 2011 certificate still trusts.
• Monitor for antivirus services unexpectedly stopping, failing to update, or showing gaps in protection history; bootkits that target specific AV engines often reveal themselves through disrupted security tooling rather than obvious malware alerts.
• Maintain an inventory of device firmware versions alongside your OS patch inventory so firmware updates are not overlooked during routine patch management.