How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
2026-10-23T20:51:46Z•306b42c1dfe4e65ef19f42cfc60e146c7a6db9ef6e544bcd13cbfd9a13ee3462
CVE-2022-21894CVE-2026-109618CVE-2026-109619APT41Active DirectoryAfricaBaton DropBlackLotusBlackXCVE exploitationCentral AsiaGroup Policy ObjectsJavaScript malwareLazarusMQTT C2Middle EastNode.js malwarePHP RCERDPSolanaUEFI bootkitaviationcryptocurrency theftfinancial servicesmacOS stealerransomwaretorrent malwarewatering hole
What happened
Kaspersky Securelist RSS items describe multiple 2026 threat campaigns, including APT41-linked BlackX UEFI bootkit activity exploiting Baton Drop (CVE-2022-21894), critical PHP remote-code-execution vulnerabilities, Lazarus watering-hole attacks, ransomware abuse of Active Directory Group Policy, torrent-delivered malware, APT activity targeting Russian organizations, macOS credential and cryptocurrency theft, and new backdoors targeting aviation, fintech, and other sectors.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 306b42c1dfe4e65ef19f42cfc60e146c7a6db9ef6e544bcd13cbfd9a13ee3462
- Enrichment time
- 2026-10-23T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.