New.
"Curiously, the file inst.exe does not contain any malicious strings or embedded blobs. All the files needed to install the malicious payload are inside PVMDIJGKAX2, which makes it harder for incident responders to retrieve the bootkit components."
Kaspersky: How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia https://securelist.com/uefi-bootkit-blackx/121539/ @Kaspersky #infosec #threatresearch #malware
SecurelistNew BlackX UEFI bootkit exploiting Baton DropKaspersky GReAT experts discovered a new UEFI bootkit, BlackX. It exploits the Baton Drop vulnerability (CVE-2022-21894) and is similar to the BlackLotus bootkit.