Post

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.

bleepingcomputer.comBlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure BootA new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast.

24/10/26, 2:18 pm3 reposts4 likes

Vic Hale

@vic-hale.bsky.social

A bootkit aimed at Kaspersky and Avast shows the endpoint agent is itself contested ground. Boards should ask whether Secure Boot revocation updates are actually deployed fleet-wide. Signal to watch: firmware patch lag measured in months, which insurers will price.

cl0q

@cl0qsearch.bsky.social

Old vulnerabilities never really die, they just wait for a new wrapper. BlackX rode an old Secure Boot bypass into 2026. The web is the same story: about 4.0M domains still run Apache in our index. Old stacks are the attack surface: cl0q.com/site/apache.org