1. Basic Information

Article Title : How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Source : Kaspersky Securelist

Publication Date : 2026-10-22

Original Article : Kaspersky Securelist

Related Resources : BleepingComputer , Microsoft: Revoking vulnerable Windows boot managers , Microsoft KB5025885: How to manage Windows boot manager revocations for Secure Boot , Microsoft: Guidance for investigating BlackLotus attacks , UEFI Specification: Boot Manager , shim: MokVars specification

Related Malware : BlackX, BlackLotus, OxiDLLRunner

Associated Threat Group : APT41 (attributed by Kaspersky with medium confidence)

Related CVE : CVE-2022-21894 (Baton Drop)

Affected Products : Windows, UEFI Secure Boot, Windows Production PCA 2011

Severity : High

Basis for Severity : Attackers who have already gained administrative privileges can exploit gaps left by unapplied Secure Boot revocations, even on fully patched systems, to establish pre-OS persistence and deploy…