How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
2026-10-24T08:51:45Z•9980dc60983b9cbae5d034c344e8d45f8d0785537bbb7dd184c88d8764b1bae7
CVE-2022-21894CVE-2026-109618CVE-2026-109619APT41Active DirectoryBaton DropBlackLotusBlackXC2CrossWeb EXGPO abuseGroup Policy ObjectsLazarusMacSyncMovieReaperNightEagleรAPTPHPPHP2ShellSolanaUEFI bootkitcrypto theftmacOS stealerransomwareremote code executiontorrent malwarewarehouse securitywatering hole
What happened
Kaspersky Securelist reports covering active and emerging cyber threats, including an APT41-linked UEFI bootkit exploiting Baton Drop (CVE-2022-21894), critical PHP remote-code-execution vulnerabilities, Lazarus watering-hole attacks, ransomware abuse of Active Directory Group Policy, torrent-delivered malware, APT campaigns, macOS data theft, and novel backdoors using cloud and messaging platforms for command and control.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 9980dc60983b9cbae5d034c344e8d45f8d0785537bbb7dd184c88d8764b1bae7
- Enrichment time
- 2026-10-24T08:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.