How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Kaspersky Securelist threat intelligence feed covering APT campaigns, malware, ransomware, UEFI bootkits, supply-chain and watering-hole attacks, Active Directory and RDP exploitation, and critical PHP remote-code-execution vulnerabilities. The most severe reported item concerns BlackX, an APT41-linked UEFI bootkit exploiting Baton Drop (CVE-2022-21894); the feed also highlights PHP2Shell vulnerabilities and active exploitation, Lazarus activity, PAYLOAD ransomware abuse of Group Policy, and multiple targeted backdoor campaigns.