Threat Actors to Watch 2026: APT41 and UAC-0099
CYJAX profiles APT41’s BlackX UEFI bootkit campaign against Central Asian diplomatic agencies and the UAC-0099 and Sandworm compromise of a Ukrainian grain logistics company, with key takeaways and defensive guidance.
APT41 is using a UEFI bootkit against Central Asian diplomatic agencies, while UAC-0099 appears to have handed a backdoor to Sandworm in Ukraine. CYJAX breaks down both threats and what defenders should do next.
Key takeaways
- APT41 deployed a new UEFI bootkit named BlackX in early 2026 against diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan.
- The bootkit abused CVE-2022-21894, even though the targets had applied the patch, because the additional revocations that accompany it had not been activated manually.
- UAC-0099 compromised a Ukrainian grain logistics company on 16 July 2025 using a spear-phishing email, then deployed the MythicRatatoskr backdoor.
- Data wiping activity on 17 September 2025 matched Sandworm tradecraft, suggesting the two groups may have collaborated.
1. APT41
Type: State-sponsored espionage | Motivation: Intelligence collection | Origin: China
Who the group is
APT41 is a Chinese state-sponsored advanced persistent threat group. Researchers attribute the BlackX campaign to it based on tooling commonly used by Chinese-speaking threat actors and similarities with earlier APT41 activity.
What it does
- Exploits the Baton Drop flaw (CVE-2022-21894) to gain administrator privileges and install the BlackX bootkit.
- Installs custom Machine Owner Keys so that arbitrary EFI files can load and Secure Boot is bypassed, in a similar manner to BlackLotus.
- Loads a malicious kernel driver that tampers with security tools, then delivers user-mode payloads including a cloud-based RAT that uses services such as Google Drive, OneDrive, and Yandex.Disk for command and control.
Why it matters
The targeted agencies had installed the patch, yet the bootkit still succeeded because the extra revocations were not applied. Government bodies across Central Asia now face a heightened risk of persistent, administrator-level accessand long-term surveillance of sensitive communications.
2. UAC-0099
Type: Espionage and disruption | Motivation: Likely political | Alignment: Likely Russia-aligned (medium confidence)
Who the group is
UAC-0099 is a threat group assessed with medium confidence to be Russia-aligned. Its activity against a Ukrainian grain logistics company overlapped with that of Sandworm, a known Russia-aligned group.
What it does
- Gains access through a spear-phishing email with a malicious attachment, leading to the MATCHBOIL downloader and MATCHWOK backdoor.
- Deploys MythicRatatoskr, a Go-based backdoor that routes command and control traffic through the Yggdrasil mesh network and can exfiltrate files and screenshots.
- Was followed by wiping activity via Group Policy that is consistent with Sandworm, alongside a SOCKS5 proxy used to obscure attacker infrastructure.
Why it matters
The company was attacked twice in a short period, which points to possible collaboration between two groups. The aim may have been to steal logistics data useful to the Russian military, or to disrupt trade within Ukraine.
Staying ahead of state-aligned and cybercriminal threats takes analyst-led intelligence, not just alerts. Book a demo with CYJAX to see how our platform helps your team act earlier.
Recommended for you
Get Started with CYJAX CTI
Empower Your Team. Strengthen Your Defences.CYJAX gives you the intelligence advantage: clear, validated insights that let your team act fast without being buried in noise.
