BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

A new UEFI bootkit called BlackX was deployed in an espionage campaign in early 2026, leveraging the known 'Baton Drop' vulnerability to bypass Secure Boot protections. The bootkit loads a malicious driver specifically designed to interfere with and disable security solutions from Kaspersky and Avast. This represents a sophisticated firmware-level attack targeting endpoint security tools. The Baton Drop vulnerability, while previously known, continues to be exploited by threat actors due to slow patching of UEFI firmware. UEFI bootkits are particularly dangerous as they persist below the operating system level, surviving reboots and OS reinstallations. The use of this technique in an espionage campaign suggests a well-resourced and skilled threat actor. The targeting of security software highlights an intent to remain undetected on compromised systems for extended periods.