MEDIUMApt
Global

How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

·Source: Securelist (Kaspersky)

Updated:

Executive Summary

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

Analysis

Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.

Indicators of Compromise (1)

CVE (1)
CVE-2022-21894
NVDMITRE CVE
Source Attribution

Originally published by Securelist (Kaspersky) on Oct 22, 2026.

Related Threats

CRITICALApt

CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP

Overview On October 21, 2026, the PHP project announced security releases for two critical vulnerabilities in PHP. CVE-2026-109618 can corrupt memory during out-of-memory (OOM) handling, while CVE-2026-109619 is a use-after-free flaw involving state retained between requests. Both have a CVSSv4 score of 9.2 and both can allow for unauthenticated remote code execution (RCE) with the web worker's pr

CVE-2026-109618CVE-2026-109619
Rapid7
MEDIUMApt

Decades-Old Windows Utility Powers Modern ClickFix Attack

The attack uses malicious Google search results related to Amazon and leverages the 'finger' utility to launch a CAPTCHA that installs malware, including the Lumma stealer.

Dark Reading
MEDIUMApt

Operation FlashHole: Lazarus breaks security, defies control

Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.

Securelist (Kaspersky)