How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
MentionsKaspersky
Kaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.
Summary from Kaspersky Securelist.
Explained
The technology and terms in this story. Learn more
- AttackBootkitMalware that infects the boot process so it runs before the operating system.
- TechnologyUEFIThe firmware that starts a computer before the operating system loads.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
