582/69 Monday, October 26, 2026
Researchers from Kaspersky have disclosed the discovery of BlackX, a UEFI bootkit that has been used in real-world attacks since early 2026. Attackers must first gain access to a system with Administrator privileges before exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and load attacker-controlled EFI files. This allows the malware to execute before Windows starts. Some affected systems had already received Windows security updates but had not fully applied the related Secure Boot revocation measures.
After obtaining Administrator privileges, the attackers install BlackX components into the System and UEFI partitions and add an attacker-controlled Machine Owner Key (MOK) to help load malicious EFI files. The malware then deploys a kernel driver to interfere with security mechanisms and reduce monitoring through Event Tracing for Windows (ETW). Researchers also identified espionage-focused payloads, including a Remote Access Trojan (RAT) that uses Google Drive, OneDrive, or Yandex.Disk as Command-and-Control (C2) channels, as well as OxiDLLRunner for loading additional components.
Administrators should keep Windows systems fully updated and verify that all Secure Boot revocation measures recommended by Microsoft have been properly applied. They should also check the Secure Boot DBX status and relevant Secure Boot certificate updates. In addition, organizations should inspect the System and UEFI partitions for suspicious modifications and use the Indicators of Compromise (IoCs) published by Kaspersky during investigations. Installing Windows updates alone may not be sufficient to protect systems from this type of attack if the required Secure Boot revocations have not also been completed.