New BlackX bootkit exploits Secure Boot flaw to target diplomatic entities

A new Unified Extensible Firmware Interface bootkit named BlackX was deployed in an espionage campaign in early 2026, bypassing Secure Boot protections on Windows systems. BleepingComputer and The Hacker News both report that the bootkit targeted diplomatic entities in Central Asia, including organizations in Tajikistan, Uzbekistan, and Turkmenistan. [1][2]

BleepingComputer, Mezha.net, and The420.in report that the bootkit exploited the old Baton Drop vulnerability to achieve the bypass. BleepingComputer and CyberSecurityNews note that BlackX loaded a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [1][3][4][5]

BleepingComputer attributes the operation with medium confidence to APT41, a Chinese state sponsored threat group also known as Brass Typhoon and Wicked Panda. The Hacker News similarly notes that the activity is suspected to be orchestrated by a China linked actor. [1][2]

Unified Extensible Firmware Interface is a specification for the firmware architecture of a computing platform. When a computer is powered on, the UEFI implementation runs first, before the operating system or any other program is loaded. [7]