Security AlertHigh
BlackX bootkit used Baton Drop flaw to bypass Secure Boot
Oct 23, 2026 · Summarized by Fundy Tech from The Globe and Mail
The 30-second version
Researchers say BlackX used the Baton Drop flaw to bypass Secure Boot on patched Windows systems. The campaign targeted diplomatic organisations in Central Asia.
Key points
- Targets included Tajikistan, Uzbekistan and Turkmenistan.
- Kaspersky links the activity with medium confidence to APT41.
- The bootkit used CVE-2022-21894 and a revoked certificate.
Why it matters
This shows some patched systems still need extra revocation steps to stay protected. Businesses and organisations with sensitive devices should confirm Secure Boot revocations are actually applied.
Who’s affected: Patched Windows systems without revocation updates
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.