Search — “APT41”

Kaspersky reports the BlackX UEFI bootkit, deployed in an espionage campaign since early 2026 against Central Asian diplomatic agencies, exploits the Baton Drop flaw to bypass Secure Boot and load a malicious kernel driver that disables security processes, registry callbacks, and ETW providers. Attribution to APT41 is medium confidence, and BlackX is similar to BlackLotus. Victims were reported to run fully patched Windows, but the Windows Production PCA 2011 revocation was not manually applied, so hunters should check that revocation status and look for googleupdate.exe sideloading of OxiDLLRunner.