Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia
Threat Actors
Excerpt
Introduction Back in October 2022, Kaspersky GReAT was looking into a peculiar advertisement on a hacking forum. A cybercriminal had been advertising a UEFI bootkit, dubbed BlackLotus, that could bypass Secure Boot, for $5,000. Given the low price for such powerful capabilities, the cybersecurity community initially took this advertisement with a grain of salt. As no BlackLotus samples were found in the wild, no one could at the time verify the claims made in the forum post.…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2022-21894 | High | Score 82/100 | First seen |
| MD5 | af8a983b9ada07eae1259bf2953abd40 | Medium | Score 53/100 | First seen |
| Domain | www.archivetj.com | High | Score 58/100 | First seen |
| MD5 | 0bcdf5e0da32d68900b8b7638459d072 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…