vulnerability
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
MediumCVSS 4.4EPSS 7%
Summary
In early 2026, a complex APT campaign targeting diplomatic agencies in Central Asia utilized a UEFI bootkit dubbed BlackX, which was similar to the previously known BlackLotus. The campaign involved deploying a malicious driver that bypassed Secure Boot and installed user-mode payloads for cyberespionage, including a RAT leveraging cloud storage for C2 communication and a DLL runner.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data