<![CDATA[BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot]]>A newly identified UEFI bootkit dubbed BlackX was used in an espionage campaign in early 2026, leveraging the older Baton Drop vulnerability to bypass Secure Boot. Once Secure Boot protections were circumvented, the bootkit loaded a malicious driver specifically built to interfere with security solutions from Kaspersky and Avast.

The key points from the report:

  • BlackX is a UEFI bootkit deployed in an espionage operation.
  • It exploits the Baton Drop flaw to bypass Secure Boot.
  • The payload includes a malicious driver designed to interfere with security products from Kaspersky and Avast.

Since the bootkit targets the boot chain before the operating system loads, traditional protections can be undermined early in startup, making detection and remediation more difficult for defenders.

Source: Unknown

Has your organization reviewed Secure Boot and boot-chain integrity protections against bootkit threats like this?

]]>https://xploitlk.com/topic/776/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-bootRSS for NodeTue, 27 Oct 2026 07:22:48 GMTSat, 24 Oct 2026 14:30:18 GMT60