How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
2026-10-25T08:51:46Z•535dc27bad844ccc4bcf8612953611fdb54fb20c168ae1b78c018a228815e505
CVE-2022-21894CVE-2026-109618CVE-2026-109619APT41Active DirectoryBaton DropBlackLotusBlackXElement Messenger C2 coordination? Why mention? Use proper tag:GhostContainerGroup PolicyHiveMQLazarusMQTTMacSyncMovieReaperNightEagleOperation FlashHolePAYLOAD ransomwarePHPRCERDPSolana blockchainToy GhoulsUEFI bootkitmacOS stealerransomwaretorrent malware
What happened
Kaspersky Securelist RSS intelligence covering recent threat activity, including the APT41-linked BlackX UEFI bootkit exploiting Baton Drop (CVE-2022-21894), critical PHP RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619), Lazarus activity, ransomware abuse of Active Directory Group Policy, malware campaigns targeting macOS, aviation, financial, diplomatic, and warehouse environments, and command-and-control concealment through Solana, MQTT, GitHub, and Element.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 535dc27bad844ccc4bcf8612953611fdb54fb20c168ae1b78c018a228815e505
- Enrichment time
- 2026-10-25T08:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.