BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
New UEFI bootkit BlackX uses Baton Drop vulnerability to bypass Secure Boot, targeting diplomatic agencies in Central Asia.
Intelligence analysis by Qwen 2.5 (3B)
A Chinese threat group, APT41, deployed a new UEFI bootkit named BlackX to bypass Secure Boot, enabling it to load malicious drivers and spy on diplomatic agencies in Central Asia.
A bad guy found a way to trick your computer's security system so they can secretly spy on important people's computers. It's like a secret door that lets them in when they shouldn't be able to.
Analysis
{"heading_1":"The Baton Drop Vulnerability","content_1":"The Baton Drop vulnerability (CVE-2022-21894) was first discovered in 2022 and has been exploited by various threat groups, including BlackLotus and BlackX.","content_2":"BlackLotus, a predecessor to BlackX, used the Baton Drop vulnerability to bypass Secure Boot and deploy a malicious driver. Kaspersky researchers found similarities between BlackX and BlackLotus, suggesting that BlackX may have been derived from reverse-engineering BlackLotus.","content_3":"The vulnerability allows attackers to enroll custom Machine Owner Keys (MOKs) and load arbitrary EFI files, enabling them to bypass Secure Boot protections. This is a significant security risk as it can compromise even fully patched Windows 11 systems."}
Key points
- BlackX UEFI bootkit uses Baton Drop vulnerability to bypass Secure Boot
- Targeted at diplomatic agencies in Central Asia
- BlackX is a copycat of BlackLotus, another UEFI bootkit that used the same vulnerability
By improving the security of UEFI components and regularly applying security updates, we can prevent such attacks from succeeding.
If attackers can find new ways to exploit vulnerabilities like Baton Drop, we may need to find even more ways to protect our computers.
