kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

APT41

3 stories · 3 in the wild · July 19, 2026 – October 25, 2026

evidence: 3 observed

sectors

  • government 1 · Oct 25

geography

  • tajikistan 1 · Oct 25
  • turkmenistan 1 · Oct 25
  • uzbekistan 1 · Oct 25
  • central asia 1 · Oct 23

malware and tools

  • blacklotus 2 · Oct 25
  • blackx uefi bootkit 1 · Oct 25
  • blackx 1 · Oct 23
  • calendarwalk 1 · Jul 19

techniques

  • secure boot bypass 2 · Oct 25
  • uefi bootkit 2 · Oct 25
  • espionage 1 · Oct 23
  • command and control 1 · Jul 19

attack phases seen

  • Defense evasion 2 · Oct 25
  • Persistence 2 · Oct 25
  • Command and control 1 · Jul 19

what we reported, newest first, grouped by story

Oct 23 – October 25, 2026 · 2 reports

  • BlackX UEFI bootkit defeats Secure Boot on fully patched Windows by abusing the fact that the CVE-2022-21894 "Baton Drop" fix requires manual DBX revocation steps most organisations never performed. Kaspersky assesses it as an updated BlackLotus, deployed against diplomatic entities in Tajikistan, Uzbekistan and Turkmenistan in early 2026, suspected APT41. The "Windows Production PCA 2011" certificate expired on October 19, 2026 — which does not stop vulnerable binaries loading unless blocklisted. It is a persistence and defence-evasion mechanism requiring existing admin or physical access, not an initial-access vector. (The Hacker News, BleepingComputer) · Oct 25 · observed · Vulnerabilities & Exploits
  • APT41 revived BlackLotus as a UEFI bootkit called BlackX. Kaspersky attributes with medium confidence a Secure Boot bypass via CVE-2022-21894 against Central Asian diplomatic targets, installing malicious EFI components and user-mode espionage payloads delivered by cloud-based RATs and obfuscated DLLs. Securelist · Oct 23 · observed · Threat Activity

July 19, 2026

  • APT41's "Calendarwalk" uses Google Calendar events as its C2 channel, reading operator commands from calendar entries to blend in with legitimate cloud traffic (via @0xpwnie). · Jul 19 · observed · Threat Activity