CERT24BlackX UEFI bootkit exploits the Baton Drop flaw to bypass Secure BootLoading data…
CERT24Threat Observatory
Period

BlackX UEFI bootkit exploits the Baton Drop flaw to bypass Secure Boot

The BlackX UEFI bootkit, used in an espionage campaign targeting diplomatic agencies in early 2026, exploited the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and load a malicious driver and espionage components. The operation was attributed with medium confidence to APT41.

← Back to intelligence

BlackX UEFI bootkit exploits the Baton Drop flaw to bypass Secure Boot

The BlackX UEFI bootkit, used in an espionage campaign targeting diplomatic agencies in early 2026, exploited the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot and load a malicious driver and espionage components. The operation was attributed with medium confidence to APT41.