A newly identified UEFI bootkit, dubbed BlackX, has been observed in cyber-espionage operations dating back to early 2026. The malicious software targets the system boot process to establish persistence and evade detection by security mechanisms.
BlackX achieves its primary objective by exploiting a known security flaw referred to as Baton Drop. By leveraging this vulnerability, the bootkit is able to bypass Secure Boot protections, a critical security feature designed to ensure that a computer boots using only software that is trusted by the Original Equipment Manufacturer (OEM).
Once the Secure Boot mechanism is successfully bypassed, the BlackX bootkit proceeds to load a malicious driver. This driver is specifically engineered to interfere with and suppress security solutions, including products from vendors such as Kaspersky and Avast. This capability allows the threat actors behind the campaign to maintain long-term access to compromised systems while evading traditional security monitoring.
The deployment of BlackX highlights the ongoing risks associated with vulnerabilities in low-level firmware, where successful exploitation can grant attackers control over a system before the operating system and its installed security software are even initialized.
Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
Leave a Reply