--- title: "#apt41 articles | Hashnode" description: "Explore 5 articles tagged #apt41 on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/apt41" --- Tag # #apt41 5 posts · 0 followers [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Nov 5](https://hashnode.com/posts/blackx-uefi-bootkit-baton-drop-en/6aec0003385fc29e8d1a1c83) ### [Fully patched machines still got a bootkit: BlackX, the BlackLotus copycat, and the patch nobody switched on](https://blog.fiscybersec.com/blackx-uefi-bootkit-baton-drop-en?utm_source=hashnode&utm_medium=feed) Summary In early 2026, Kaspersky GReAT identified an APT campaign against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan that involved a UEFI bootkit they named BlackX. On examination, 14 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/blackx-uefi-bootkit-baton-drop-en?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Oct 26](https://hashnode.com/posts/alert-blackx-cve-2022-21894-uefi-bootkit-secure-boot/6ae35896b97904c1db65fe6d) ### [BlackX CVE-2022-21894: Secure Boot Bypass on Patched Systems](https://404-founders.com/blog/alert-blackx-cve-2022-21894-uefi-bootkit-secure-boot?utm_source=hashnode&utm_medium=feed) Kaspersky discloses BlackX UEFI bootkit exploiting CVE-2022-21894. APT41 targets Central Asian diplomats. Fully patched Windows at risk. Apply KB5025885. 7 min read · [404-founders.com](https://404-founders.com/blog/alert-blackx-cve-2022-21894-uefi-bootkit-secure-boot?utm_source=hashnode&utm_medium=feed) [Steven Stone](https://hashnode.com/@redsheep) · [Mar 18](https://hashnode.com/posts/apt41s-expanding-arsenal-google-calendar-c2-silver-dragon-and-the-persistent-threat-to-us-defense-and-healthcare/69ba7ef852ffd67f055f2f0b) ### [APT41's Expanding Arsenal: Google Calendar C2, Silver Dragon, and the Persistent Threat to U.S. Defense and Healthcare](https://redsheeptrends.hashnode.dev/apt41s-expanding-arsenal-google-calendar-c2-silver-dragon-and-the-persistent-threat-to-us-defense-and-healthcare?utm_source=hashnode&utm_medium=feed) APT41 deploys TOUGHPROGRESS malware with Google Calendar C2, launches Silver Dragon sub-cluster, and continues targeting U.S. defense and healthcare infrastr... 29 min read · [redsheeptrends.hashnode.dev](https://redsheeptrends.hashnode.dev/apt41s-expanding-arsenal-google-calendar-c2-silver-dragon-and-the-persistent-threat-to-us-defense-and-healthcare?utm_source=hashnode&utm_medium=feed) [Satyam Rastogi](https://hashnode.com/@satyamrastogi) · [Mar 4](https://hashnode.com/posts/silver-dragon-apt-google-drive-c2-cobalt-strike-government-ttps/69a839ae751c534a61119a8c) ### [Silver Dragon APT: Google Drive C2 & Cobalt Strike Government TTPs](https://satyamrastogi.hashnode.dev/silver-dragon-apt-google-drive-c2-cobalt-strike-government-ttps?utm_source=hashnode&utm_medium=feed) Originally published on satyamrastogi.com Silver Dragon APT exploits public servers and delivers phishing campaigns with Cobalt Strike payloads, using Google Drive as command and control infrastructure to target European and Southeast Asian governme... 5 min read · [satyamrastogi.hashnode.dev](https://satyamrastogi.hashnode.dev/silver-dragon-apt-google-drive-c2-cobalt-strike-government-ttps?utm_source=hashnode&utm_medium=feed)