BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
73
Country
Turkmenistan
- Mentions · 7d3
- Mentions · 30d12
- All mentions19
- First seenAug 20, 2026
- Last mentioned4d ago
Timeline
19 articles · newest firstBlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
74
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
76
BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
74
BlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
74
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
76
APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
76
Tor Project recounts building Tor VPN Beta for Android
Each app gets its own Tor circuit, and WebTunnel bridges arrived in 1.4.0 beta after censored-region use reshaped the product.
36
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
Silent Lynx used a WinRAR flaw and phishing to plant reverse shells on CIS government targets.
76
UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
UAT-6275 used WinRAR CVE-2025-8088 to plant reverse shells on CIS government systems via malicious archives.
78
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
Kazakhstan-linked UAT-6275 targeted CIS governments using phishing and a WinRAR exploit.
78
TAG-193’s Regional Espionage Operations
TAG-193 ran regional government espionage, adding WinRAR CVE-2025-8088 exploitation to its phishing and reverse-shell toolkit.
76
SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets
Hunt.io linked SpiceRAT, NodeEdgeRAT, and NomadRAT C2 servers to the SilkParasite campaign targeting Central Asian governments since mid-2022.
72
SilkParasite Hackers Use SpiceRAT Infrastructure to Target Central Asian Governments and Energy Firms
Hunt.io links SpiceRAT C2 infrastructure to the China-nexus SilkParasite espionage cluster targeting Central Asian governments, telecoms, and energy firms.
55
SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia
Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.
60
Fake GTA 6 leaked copy drains your crypto wallet
A fake GTA 6 leaked-copy website loads a multi-chain crypto wallet drainer that sweeps Solana balances and can steal assets across seven blockchain networks.
35
China's AI-Enabled APT Operations Are Getting Interesting
Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.
72
China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI
Bitdefender attributes the SilkParasite espionage campaign to China-linked actors using five new malware strains and AI-assisted development to target Central Asian governments.
74
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.
70
Related CVEs
by mentions- CVE-2022-218947%4.4Secure Boot Security Feature Bypass Vulnerability
- CVE-2025-808894%8.4WinRAR Path Traversal (CVE-2025-8088) Enables Arbitrary Code Execution
- CVE-2025-25257100%9.8Critical Unauthenticated SQL Injection in Fortinet FortiWeb (CVE-2025-25257)
- CVE-2023-2493211%6.7Secure Boot Security Feature Bypass Vulnerability
Appears with
- Microsoftvendor · 8
- BlackLotusmalware · 7
- Windowsproduct · 7
- APT41threat actor · 7
- OxiDLLRunnermalware · 7
- BlackXmalware · 7
- Kasperskyorganization · 5
- Cisco Talosorganization · 5
- Bitdefendervendor · 5
- SilkParasitethreat actor · 5
- TAG-193threat actor · 4
- NomadRATproduct · 4
- SpiceRATproduct · 4
- Recorded Futureorganization · 4
- UAT-6275threat actor · 4
- Silent Lynxthreat actor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.