🔍 BlackX uses Bon Drop to bypass Secure Boot Kaspersky says that BlackX UEFI Jetkit was used in an early 2026 espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The malicious code exploited CVE-2022-21894, or Baton Drop, to register Machine Controller Keys and sample arbitrary EFI files despite fully optimized Windows systems. BlackX also deployed a signed kernel driver with ETW and targeted Kaspersky and Avast processors. The case highlights a permanent boot gap: patching alone did not apply the required designations, which still had to be activated manually by system administrators. Practically, this keeps exploiting the old transient chain viable against hardened targets and gives post-exploitation payloads kernel-level protection before user-space protection is fully engaged. 🛰️ Open sources - closed narratives.

🔍 BlackX uses Bon Drop to bypass Secure Boot Kaspersky says that BlackX UEFI Jetkit was used in an early 2026 espionage campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan. The malicious code exploited CVE-2022-21894, or Baton Drop, to register Machine Controller Keys and sample arbitrary EFI files despite fully optimized Windows systems. BlackX also deployed a signed kernel driver with ETW and targeted Kaspersky and Avast processors. The case highlights a permanent boot gap: patching alone did not apply the required designations, which still had to be activated manually by system administrators. Practically, this keeps exploiting the old transient chain viable against hardened targets and gives post-exploitation payloads kernel-level protection before user-space protection is fully engaged. 🛰️ Open sources - closed narratives.