The Kaspersky Global Research and Analysis Team (GReAT) has uncovered a sophisticated new bootkit, BlackX, which made attacks possible by exploiting an inefficiency in a security update published by Microsoft. The experts attributed the campaign with moderate confidence to the APT41 group, identifying BlackX as a modernised successor to the notorious BlackLotus bootkit.
In early 2026, Kaspersky security solutions successfully prevented an APT attack on diplomatic organisations in Central Asia. The subsequent research* by Kaspersky GReAT revealed that the attackers used BlackX, a complex and stealthy malware specifically designed to bypass Windows operating system’s startup defences along with many third-party security solutions, and maintain invisible, long-term access to victims’ devices.
The investigation revealed that BlackX represents an updated, modernised version of an implant called BlackLotus, which was sold on the dark web in 2022 by cybercriminals. It can bypass the Secure Boot feature, designed to ensure only trusted software runs when a PC starts up. This has been achieved by exploiting a previously known vulnerability called “Baton Drop”. Although Microsoft released a patch for this flaw, the update requires system administrators to manually complete certain configuration steps to fully activate the protection. Many organisations have not performed these manual steps and remained vulnerable. As such, attackers have been able to use the Baton Drop vulnerability even on systems with the patch installed.
The attackers deployed the BlackX bootkit as a secondary, highly persistent malware after already compromising the internal networks and securing administrative privileges on the victims’ Windows machines. To hide their activities from incident responders, the attackers delivered the bootkit components to victim devices using encrypted files and custom installer programs specifically designed to evade detection.
Following the successful exploit, BlackX deploys a component that disables security software. Notably, Kaspersky’s endpoint protection blocked the malware’s attempt to disable it, and the attack failed. If they succeeded in disabling security protection, the next step for the attackers would have been to run spyware that abuses legitimate cloud services like Google Drive, OneDrive and Yandex Disk to steal confidential information and monitor victims’ activities.
“The emergence of BlackX is notable because we rarely see APT groups borrow code or concepts – in this case, BlackLotus – directly from the cybercrime underground. By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes. This hybrid approach proves that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks,” said Georgy Kucherin, security expert at Kaspersky GReAT.
The full report is available on Securelist.
To defend against this and similar threats, organisations must ensure their IT departments manually execute Microsoft’s recommended steps to close Baton Drop and other similar vulnerabilities. Furthermore, organisations should restrict administrative privileges and deploy security solutions capable of monitoring firmware integrity. Kaspersky’s Exploit Prevention component in endpoint solutions prevents exploits from running even if the patch is not applied, or if it is a zero-day vulnerability for which a patch does not exist.
*The research was presented at the Security Analyst Summit 2026 in Bali, Indonesia.
