CVE-2022-21894
APT41 Exploits CVE-2022-21894 via BlackX Bootkit Targeting Central Asian Diplomatic Entities
Vendor / product: Microsoft Windows Secure Boot
Event date: 2026-01-01
Public PoC: Yes
First tracked by RiskWire: 2026-10-24
Named threat actors
APT41FishMonger
Sources & citations (5)
- Diplomatic entities in Central Asia targeted by new BlackX UEFI bootkit scworld.com · 2026-10-23
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations thehackernews.com · 2026-10-23
- BlackX: New UEFI bootkit targets diplomatic missions secnews.gr · 2026-10-23
- BlackXが中央アジアの外交機関を標的に Windows更新後も必要なSecure Boot対策 zaikei.co.jp · 2026-10-24
- Предположительно, группировка APT41 развернула буткит BlackX в сетях дипломатических организаций cisoclub.ru · 2026-10-23
References
See CVE-2022-21894 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →