APT41
Nation-state Mixed China Active
Aliases: Wicked Panda · Barium · Double Dragon · Brass Typhoon · Winnti
- Mentions
- 1
- First seen
- 22 Oct 2026
- Last seen
- 22 Oct 2026
Relevant to you · Relevant
- Threat focus:
- espionage / aptindustrial / ot espionage
- Sector / region:
- Manufacturing
Origin
China — Chinese state-linked (MSS contractors)
Profile
APT41 has revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia. The threat actor deployed this advanced malware to compromise systems. The attacks targeted diplomatic institutions in the Central Asia region. Further details on affected countries are not known from the reporting.
Affected vendors
Microsoft
Targeted sectors
Diplomatic organizations
Targeted regions
Central Asia
Associated malware / tools
BlackLotus
Linked CVEs
- CVE-2022-21894 CVSS 4.4 EPSS 7%