APT41 deploys BlackX bootkit to bypass Secure Boot via Baton Drop

The BlackX UEFI bootkit, observed in early 2026, leveraged CVE‑2022‑21894 (Baton Drop) to enroll custom Machine Owner Keys and load arbitrary EFI drivers, bypassing Secure Boot and targeting Kaspersky and Avast solutions in Central Asian diplomatic agencies. Attribution with medium confidence points to the Chinese APT41 group.

Why it matters

Add verification steps for custom Machine Owner Keys to prevent bootkits like BlackX from loading arbitrary EFI files.

For product managers

For your product

What does this mean for your product?

Try it on your product

Read at BleepingComputer

More from this issueAll AI news from 26 Oct →

OpenAI launches Decisions API, entering Jev decision‑model marketAvailable now

SpaceX secures $40 billion debt financing to buy AI GPUs

OpenAI offers up to 90% discounts to poach Anthropic's biggest customersAvailable now

Hugging Face Releases Carbon‑X 14.8B Open DNA Language ModelAvailable now

Get this every morning, written for your product.

Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.

Request an invite See how it works