How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
2026-10-24T20:51:46Z•687e0c3bcb735e1ddea1e0bbce1b50c48836fae7be9f0da4dba7d3be815dc795
CVE-2022-21894CVE-2026-109618CVE-2026-109619APT41Active DirectoryBaton DropBlackLotusBlackXGroup Policy ObjectsLazarusMQTT C2Matrix/ElementMirage KittenNightEaglePHP RCERDPSolana blockchainToy GhoulsUEFI bootkitcritical infrastructurefinancial servicesmacOS stealerransomwaresupply chaintorrent malwarewatering hole
What happened
Kaspersky Securelist reports covering multiple 2026 cyber threats, including the BlackX UEFI bootkit attributed to APT41 and exploiting CVE-2022-21894, critical PHP remote-code-execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, Lazarus watering-hole activity, macOS infostealing, ransomware abuse of Active Directory Group Policy, torrent-delivered malware, APT campaigns targeting Russian, Middle Eastern, African, aviation, and financial-sector organizations, and novel backdoors using MQTT and Matrix infrastructure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 687e0c3bcb735e1ddea1e0bbce1b50c48836fae7be9f0da4dba7d3be815dc795
- Enrichment time
- 2026-10-24T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.