MEDIUMApt
Global

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

·Source: BleepingComputer

Updated:

Executive Summary

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]

Analysis

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. [...]
Source Attribution

Originally published by BleepingComputer on Oct 24, 2026.

Related Threats

MEDIUMApt

BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations

Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report

The Hacker News
CRITICALApt

Oracle patches 1295 security vulnerabilities in October, including six scoring 10.0

Oracle has patched 1295 security vulnerabilities with its October Critical Patch Update Advisory ; six of them scored the highest vulnerability rating of 10.0 on the CVSS version 3.1 scale. The company’s flagship Oracle E-Business Suite was home to one of the vulnerabiltiies, tracked as CVE-2026-101809 . This enables any unauthenticated attacker with network access via HTTP to compromise the workf

CVE-2026-101809CVE-2026-91231
CSO Online
CRITICALApt

Dual BIOS: The laptop security feature SMBs don’t know they need

Every security checklist starts with the basics: strong passwords, multifactor authentication, spotting phishing, and keeping software up to date. All four protect what happens after a laptop starts. But some attackers are more focused on what happens before. That’s the domain of the BIOS, the first code that runs when a laptop powers on. It checks the hardware, then hands control to the operating

CSO Online