A new UEFI bootkit, BlackX, has been observed in an espionage campaign targeting diplomatic organizations in Central Asia. BlackX exploits the ‘Baton Drop’ vulnerability (CVE-2022-21894) to bypass Secure Boot on patched Windows systems, even those missing specific revocations. Once loaded, the bootkit deploys a malicious driver designed to interfere with security solutions from vendors like Kaspersky and Avast, indicating a sophisticated, state-sponsored threat, likely linked to APT41.