How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Reported by Kaspersky Securelist (Georgy Kucherin, Vladimir Nestor, Vasily Berdnikov)

Summary by Cyber Security News22 Oct 2026, 08:00 CET

About this summary. This is a short excerpt from the description that Kaspersky Securelist published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securelist.com/uefi-bootkit-blackx/121539/

Introduction Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt.

Read the full article at Kaspersky Securelist →

Source attribution: headline and facts are from Kaspersky Securelist (securelist.com). Summary method: excerpt of the source description. See our source attribution policy.