A new UEFI bootkit called BlackX was deployed in early 2026 to target diplomatic agencies in Central Asia, exploiting the Baton Drop vulnerability to bypass Secure Boot and interfere with security solutions from Kaspersky and Avast.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2022-21894 | 4.4 | MEDIUM | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations (2026-10-23)
Business impact
Organizations could face significant operational disruptions and potential data breaches if their systems are compromised by the BlackX bootkit, leading to financial losses and reputational damage.
Industries affected
The attack primarily targeted diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan, affecting government and related sectors.
Users affected
Users of Kaspersky and Avast security solutions could be at risk, as the malicious driver was designed to interfere with these products, potentially leaving systems vulnerable to further attacks.
Build these skills
Sources
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot (BleepingComputer)
