How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky Securelist reporting covers multiple 2026 threat campaigns, including APT41-linked BlackX UEFI bootkit activity exploiting Baton Drop (CVE-2022-21894), critical PHP remote-code-execution vulnerabilities, Lazarus watering-hole attacks, ransomware abuse of Active Directory Group Policy, torrent-delivered malware, APT campaigns targeting aviation, finance, and Russian organizations, and new macOS and Windows backdoors. The most severe items involve boot-level persistence, remote code execution, and enterprise directory compromise.