BlackX bootkit slips past Secure Boot by abusing a 2022 flaw
Discovered in early 2026, BlackX is a UEFI‑level bootkit that leverages the "Baton Drop" vulnerability (CVE‑2022‑21894) to sidestep Secure Boot checks.
How it works
The Baton Drop flaw lets an attacker bypass the cryptographic chain that Secure Boot enforces. BlackX drops a malicious Windows kernel driver that is signed with a certificate issued to Wenjiang District Mingyu Network Technology Service Studio. Although the "Windows Production PCA 2011" certificate was later revoked, the revocation does not propagate automatically after the associated patch is applied, leaving a brief window for abuse. The driver disables security‑related processes, blocks registry callbacks, and even rewrites Event Tracing for Windows (ETW) providers. When a protected file is accessed, the bootkit can hijack the request and pop up the Windows Calculator as a distraction.
Who is being targeted
BlackX checks for the presence of Kaspersky or Avast security solutions before it activates its payload. Any Windows 11 system that runs those products and relies on the default Secure Boot configuration is a potential victim.
What you can do today
Patch is only half the story. Administrators should:
- Manually enforce revocation of the "Windows Production PCA 2011" certificate after installing the Baton Drop patch.
- Confirm Secure Boot is enabled and that the firmware’s revocation list is up‑to‑date.
- Audit kernel driver loads for unsigned or newly signed drivers that reference the revoked certificate.
- Monitor ETW provider registrations for unexpected changes.
- Deploy endpoint detection that flags Calculator launches that are not user‑initiated.
At the moment, attribution to APT41 is being discussed, but the link remains unconfirmed.