CVE-2022-21894: Patched in 2022, a Windows boot flaw is still being used to spy on diplomats

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

Patched in 2022, a Windows boot flaw is still being used to spy on diplomats

Kaspersky attributes to APT41 a hidden program planted in the boot process of Central Asian diplomats' PCs. Microsoft's countermeasure has existed since 2023, but it doesn't turn on by itself: the procedure and its risks.

Oct 27, 20263 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)