Security researchers have uncovered a new UEFI bootkit, named BlackX, that was deployed in an espionage campaign in early 2026. The malware leverages the previously disclosed Baton Drop vulnerability to circumvent the Secure Boot feature of modern computers and install a malicious driver.
BlackX’s primary objective is to interfere with endpoint protection products, specifically targeting security solutions from Kaspersky and Avast. By loading the driver after bypassing Secure Boot, the bootkit can operate at a low level in the system, potentially undermining the effectiveness of those anti‑malware tools.
The Baton Drop flaw, first reported several years ago, remains exploitable in many firmware implementations despite the availability of patches. BlackX demonstrates that attackers continue to weaponize older vulnerabilities to achieve persistence on compromised devices.
Secure Boot, a component of the UEFI firmware standard, is designed to ensure that only trusted software runs during the boot process. The successful bypass of this protection by BlackX highlights ongoing challenges in maintaining firmware security across diverse hardware platforms.
Researchers advise organizations to verify that their devices are running the latest firmware updates that address Baton Drop and to monitor for any unusual driver activity, especially on systems that rely on Kaspersky or Avast security suites.
<small>Source: Bleeping Computer — read the original story there.</small>
