Our takeBlackX bootkit uses the old Baton Drop flaw (still unrevoked on some patched Windows systems) to bypass Secure Boot and load a driver that disables Kaspersky and Avast. If you haven't applied the revocation updates, do it now.Security Resilience desk
Sources (2)
- hackernews · hackernews
- bleeping · bleeping
What this means for you — Security leader:Apply the latest Microsoft UEFI revocation updates and ensure your endpoint protection (including Kaspersky/Avast) is not being explicitly targeted or disabled by bootkits. Review firmware update processes for diplomatic or high-value assets in Central Asia.
What this means for you — Lean IT orgs:Make sure Windows is fully updated and that your PC firmware settings still require Secure Boot. If you run Kaspersky or Avast, watch for any unexpected changes to those programs.
What this means for you — MSP:Push latest Windows UEFI revocation updates to all managed clients; verify Secure Boot remains enforced and monitor for boot-time tampering that could disable Kaspersky or Avast agents.
What this means for you — Researcher:Examine how BlackX reuses the still-unrevoked Baton Drop vulnerability and test your own UEFI analysis tooling against the reported driver that interferes with specific AV products.