New research: in 2022, BlackLotus, a UEFI bootkit bypassing Secure Boot via CVE-2023-24932, went on sale on the dark web. Microsoft's fixes against this vulnerability didn't do their job fully. APT41 noticed that and reused the same bootkit against diplomatic targets! [1/n]

Security updates are ordinarily supposed to patch vulnerabilities without any additional, manually executed steps - as such, it's a no wonder that many organizations remained unprotected against BlackLotus even after installing appropriate patches. [9/n]

I presented this research yesterday at @TheSAScon - if you are interested in more details of this attack, you can check out the Securelist article available at securelist.com/uefi-bootkit-b… [10/n]

🧱 The OS hasn't even booted yet, and the attackers are already in.
Georgy Kucherin (@kucher1n) takes the #TheSAS2026 stage to dissect BlackX, a UEFI bootkit uncovered in a sophisticated campaign targeting diplomatic organizations.
Kernel-level tricks, hidden payloads, failed lues pointing to APT41.
Turns out, some threats don't wait for Windows to wake up.

In a few minutes I will be giving a talk on deobfuscation at the Virus Bulletin conference in Seville. If you are hanging out at #VB2026, come watch it to learn some new things about IDA!

Together with @bzvr_, @2igosha and Anton Kargin, we identified that the DAEMON Tools software has been compromised in a complex supply chain attack since April 8. We see thousands of infections across 100+ countries. If you use DAEMON Tools, run a malware scan immediately! [1/7]

Furthermore, we observed just one of the organizations to receive a unique RAT that is able to inject payloads and can use a wide range of protocols for C2 server communications - including WSS, QUIC, DNS and HTTP/3.

Analysis of this implant is currently ongoing. [6/7]

Given that this supply chain attack is highly complex, we urge everyone who uses DAEMON Tools to isolate their machines and initiate a security sweep to ensure protection against malware. You can refer to the IoCs that we published in our blogpost, securelist.com/tr/daemon-tool…. [7/7]

The CPU-Z and HWMonitor incident is the sloppiest supply chain attack I've EVER seen. The payloads have been copy-pasted from a previous attack, with C2 server reuse. The final implant, STX RAT, wasn't even cleaned from detections with PUBLICLY available Yara rules!🤦[1/4]

However, the malicious payloads have been deployed INCREDIBLY sloppily. The C2 server address referenced in the loader has been documented by @Malwarebytes, and the final payload, which is a known RAT dubbed STX RAT, is detected with YARA rules from @eSentire's research. [3/4]

The reused payloads made this attack VERY EASY to detect. If you had a decent security solution running, it must have caught the malicious files. However, it's always worth double-checking things, for example with IoCs from our article, securelist.com/tr/cpu-z/11936… [4/4]