Sednit APT Group Uses First UEFI Rootkit Detected in the Wild to Execute LoJax Malware

For the first time ever, researchers discovered a Unified Extensible Firmware Interface (UEFI) rootkit in the wild that they believe the Sednit advanced persistent threat (APT) group used to execute LoJax malware.

Researchers at ESET observed an attack campaign distributing LoJax and three types of tools. The first component dumped system information into a text file. The second tool read the contents of the Serial Peripheral Interface (SPI) flash memory to save an image of the system’s firmware. The third wrote a UEFI module to the SPI flash memory and installed a UEFI rootkit that’s responsible for dropping LoJax onto the machine.

All Signs Point to Sednit

LoJax is a Trojanized version of LoJack, antitheft software that uses a UEFI and Basic Input/Output System (BIOS) module to help it resist operating system (OS) reinstallations and hard drive replacements. LoJax uses this same persistence method but calls to a malicious command-and-control (C&C) server.

ESET recognized some of the domains used by LoJax as those employed by SedUploader, the first-stage backdoor of Sednit. This discovery, along with other evidence, led ESET to attribute the campaign and UEFI rootkit to the APT group.

The UEFI rootkit used to distribute LoJax may be the first of its kind discovered in the wild, but researchers have uncovered others like it outside of active attack campaigns. Back in 2015, McAfee found a UEFI-based rootkit in the Hacking Team data breach. Individuals have also disclosed proof-of-concept UEFI rootkits on YouTube.

How to Defend Against LoJax Malware and UEFI Rootkits

According to ESET, organizations can defend themselves against LoJax malware and UEFI rootkits by enabling Secure Boot. The researchers also urged security teams to use the latest UEFI/BIOS available for their motherboard. Updating UEFI/BIO can result in performance degradation, so security professionals should consult their application vendors to determine the potential impact to their environments.

Sources: ESET, McAfee, YouTube

David Bisson

Contributing Editor

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Evolving red teaming for AI environments

2 min read - As AI becomes more ingrained in businesses and daily life, the importance of security grows more paramount. In fact, according to the IBM Institute for Business Value, 96% of executives say adopting generative AI (GenAI) makes a security breach likely in their organization in the next three years. Whether it’s a model performing unintended actions, generating misleading or harmful responses or revealing sensitive information, in the AI era security can no longer be an afterthought to innovation.AI red teaming is emerging…

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

All Signs Point to Sednit

How to Defend Against LoJax Malware and UEFI Rootkits

More from

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

Evolving red teaming for AI environments

What we can learn from the best collegiate cyber defenders

Topic updates