How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post. The researchers tracked down samples of this bootkit and confirmed that it can indeed bypass Secure Boot through a vulnerability called Baton Drop (CVE-2022-21894). As this vulnerability was still exploitable in 2023, Microsoft had to release multiple security updates to address it. Since the release of these updates, the BlackLotus bootkit has gone quiet — no publicly known attacks have used it.

Published 22-Oct-2026 07:08 UTC · First seen 22-Oct-2026 07:07 UTC

Sources

• Kaspersky Securelist · 22-Oct-2026