The Kaspersky Global Research and Analysis Team (GReAT) has uncovered a sophisticated new bootkit, BlackX, which made attacks possible by exploiting an inefficiency in a security update published by Microsoft. The research, which details how attackers implanted malware that runs before Windows starts up, was presented at the Security Analyst Summit 2026 in Bali, Indonesia. The experts attributed the campaign with moderate confidence to the APT41 group, identifying BlackX as a modernized successor to the notorious BlackLotus bootkit. In early 2026, Kaspersky security solutions successfully prevented an APT attack on diplomatic organizations in Central Asia. The subsequent investigation by Kaspersky GReAT revealed that the attackers used BlackX, a complex and stealthy malware specifically designed to bypass Windows operating system’s startup defenses along with many third-party security solutions, and maintain invisible, long-term access to victims’ devices.
The research revealed that BlackX represents an updated, modernized version of an implant called BlackLotus, which was sold on the dark web in 2022 by cybercriminals. It can bypass the Secure Boot feature, designed to ensure only trusted software runs when a PC starts up. This has been achieved by exploiting a previously known vulnerability called “Baton Drop”. Although Microsoft released a patch for this flaw, the update requires system administrators to manually complete certain configuration steps to fully activate the protection. Many organizations have not performed these manual steps and remained vulnerable. As such, attackers have been able to use the Baton Drop vulnerability even on systems with the patch installed.
The attackers deployed the BlackX bootkit as a secondary, highly persistent malware after already compromising the internal networks and securing administrative privileges on the victims’ Windows machines. To hide their activities from incident responders, the attackers delivered the bootkit components to victim devices using encrypted files and custom installer programs specifically designed to evade detection.
Following the successful exploit, BlackX deploys a component that disables security software. Notably, Kaspersky’s endpoint protection blocked the malware’s attempt to disable it, and the attack failed. If they succeeded in disabling security protection, the next step for the attackers would have been to run spyware that abuses legitimate cloud services like Google Drive, OneDrive and Yandex Disk to steal confidential information and monitor victims’ activities.
“The emergence of BlackX is notable because we rarely see APT groups borrow code or concepts – in this case, BlackLotus – directly from the cybercrime underground. By adapting a commercial crimeware tool, the group could bypass procedures intended to protect the Windows boot processes. This hybrid approach proves that sophisticated adversaries do not need to reinvent the wheel to establish persistent, invisible control over high-value networks,” said Georgy Kucherin, security expert at Kaspersky GReAT.
The full report is available on Securelist.
To defend against this and similar threats, organizations must ensure their IT departments manually execute Microsoft’s recommended steps to close Baton Drop and other similar vulnerabilities. Furthermore, organizations should restrict administrative privileges and deploy security solutions capable of monitoring firmware integrity. Kaspersky’s Exploit Prevention component in endpoint solutions prevents exploits from running even if the patch is not applied, or if it is a zero-day vulnerability for which a patch does not exist.
About the Global Research & Analysis Team
Established in 2008, Global Research & Analysis Team (GReAT) operates at the very heart of Kaspersky, uncovering APTs, cyber-espionage campaigns, major malware, ransomware and underground cyber-criminal trends across the world. Today GReAT consists of 35+ experts working globally – in Europe, Russia, Latin America, Asia and the Middle East. Talented security professionals provide company leadership in anti-malware research and innovation, bringing unrivaled expertise, passion and curiosity to the discovery and analysis of cyberthreats.
