BlackX Bootkit Exploits Legacy Baton Drop Flaw to Evade Secure Boot, Targets Kaspersky and Avast

A new UEFI bootkit identified as BlackX has been linked to an espionage operation that began in early 2026. Security analysts say the malware leverages the long‑standing Baton Drop vulnerability to circumvent the Secure Boot feature built into modern firmware, allowing the malicious code to load before the operating system starts.

UEFI bootkits operate at a low level of the boot process, giving attackers the ability to execute code before typical security controls are engaged. Secure Boot is designed to verify the integrity of bootloaders and drivers, blocking unsigned or tampered components. By breaking this chain of trust, BlackX can install its payload without triggering conventional defenses.

The Baton Drop flaw, first disclosed several years ago, resides in the way certain firmware implementations handle pointer validation during the boot sequence. Although patches have been released, many devices remain unpatched, especially older or legacy systems. BlackX appears to exploit an unaddressed code path, reactivating the vulnerability to gain the same level of privilege that Secure Boot is meant to protect.

Once the bootkit establishes a foothold, it drops a custom driver that specifically interferes with security solutions from Kaspersky and Avast. The driver is designed to disable key scanning functions and hide the presence of additional malicious components, effectively blinding two of the most widely used antivirus products. This targeted approach suggests the operators are interested in maintaining long‑term stealth on compromised machines.

The campaign was first reported by BleepingComputer after researchers observed the bootkit in the wild and traced its activity to a coordinated espionage effort. While no nation‑state has been publicly named, the sophistication of the firmware exploitation and the focus on high‑profile security tools point to a well‑funded adversary with a strategic objective. The discovery underscores the ongoing relevance of firmware‑level attacks in modern cyber‑espionage.

Experts recommend that organizations audit firmware versions across their asset base and apply any available updates from hardware vendors. In environments where patches are not yet released, deploying complementary integrity‑checking tools and monitoring for anomalous driver loading can provide additional layers of defense. As the threat landscape evolves, the BlackX incident highlights the need for continuous vigilance at the very foundation of the computing stack.