How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
2026-10-26T08:51:45Z•4ea8e59052193c8292c6a3ec7ab3d2efcd36ed2b8a977ae55427c2e3b189f3f1
CVE-2022-21894CVE-2026-109618CVE-2026-109619APTAPT41Active DirectoryBaton DropBlackLotusBlackXGroup Policy ObjectsLazarusMQTT C2PHP RCERDP exploitationSolana C2UEFI bootkitaviationbackdoorcrypto theftfinancial servicesmacOS stealerransomwaretorrent malwarewatering-hole attack
What happened
Kaspersky Securelist feed reporting on multiple 2026 cyber threat developments, including APT41 use of the BlackX UEFI bootkit exploiting CVE-2022-21894, critical PHP remote-code-execution vulnerabilities, Lazarus watering-hole attacks, ransomware abuse of Active Directory Group Policy, malware campaigns targeting macOS, torrents, aviation, financial services, and organizations in Central Asia, the Middle East, Africa, and Russia.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 4ea8e59052193c8292c6a3ec7ab3d2efcd36ed2b8a977ae55427c2e3b189f3f1
- Enrichment time
- 2026-10-26T08:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.