Sednit APT Group Uses First UEFI Rootkit Detected in the Wild to Execute LoJax Malware

For the first time ever, researchers discovered a Unified Extensible Firmware Interface (UEFI) rootkit in the wild that they believe the Sednit advanced persistent threat (APT) group used to execute LoJax malware.

Researchers at ESET observed an attack campaign distributing LoJax and three types of tools. The first component dumped system information into a text file. The second tool read the contents of the Serial Peripheral Interface (SPI) flash memory to save an image of the system’s firmware. The third wrote a UEFI module to the SPI flash memory and installed a UEFI rootkit that’s responsible for dropping LoJax onto the machine.

All Signs Point to Sednit

LoJax is a Trojanized version of LoJack, antitheft software that uses a UEFI and Basic Input/Output System (BIOS) module to help it resist operating system (OS) reinstallations and hard drive replacements. LoJax uses this same persistence method but calls to a malicious command-and-control (C&C) server.

ESET recognized some of the domains used by LoJax as those employed by SedUploader, the first-stage backdoor of Sednit. This discovery, along with other evidence, led ESET to attribute the campaign and UEFI rootkit to the APT group.

The UEFI rootkit used to distribute LoJax may be the first of its kind discovered in the wild, but researchers have uncovered others like it outside of active attack campaigns. Back in 2015, McAfee found a UEFI-based rootkit in the Hacking Team data breach. Individuals have also disclosed proof-of-concept UEFI rootkits on YouTube.

How to Defend Against LoJax Malware and UEFI Rootkits

According to ESET, organizations can defend themselves against LoJax malware and UEFI rootkits by enabling Secure Boot. The researchers also urged security teams to use the latest UEFI/BIOS available for their motherboard. Updating UEFI/BIO can result in performance degradation, so security professionals should consult their application vendors to determine the potential impact to their environments.

Sources: ESET, McAfee, YouTube

David Bisson

Contributing Editor

How to calculate your AI-powered cybersecurity’s ROI

4 min read - Imagine this scenario: A sophisticated, malicious phishing campaign targets a large financial institution. The attackers use emails generated by artificial intelligence (AI) that closely mimic the company's internal communications. The emails contain malicious links designed to steal employee credentials, which the attackers could use to gain access to company assets and data for unknown purposes.The organization's AI-powered cybersecurity solution, which continuously monitors network traffic and user behavior, detects several anomalies associated with the attack, blocks access to the suspicious domains…

Being a good CLR host – Modernizing offensive .NET tradecraft

14 min read - The modern red team is defined by its ability to compromise endpoints and take actions to complete objectives. To achieve the former, many teams implement their own custom command-and-control (C2) or use an open-source option. For the latter, there is a constant stream of post-exploitation tooling being released that takes advantage of various features in Windows, Active Directory and third-party applications. The execution mechanism for this tooling has, for the last several years, relied heavily on executing .NET assemblies in…

The current state of ransomware: Weaponizing disclosure rules and more

4 min read - As we near the end of 2024, ransomware remains a dominant and evolving threat against any organization. Cyber criminals are more sophisticated and creative than ever. They integrate new technologies, leverage geopolitical tensions and even use legal regulations to their advantage.What once seemed like a disruptive but relatively straightforward crime has evolved into a multi-layered, global challenge that continues to threaten businesses and governments alike.Let’s take a look at the state of ransomware today. We’ll focus on how cyber criminals…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

All Signs Point to Sednit

How to Defend Against LoJax Malware and UEFI Rootkits

More from

How to calculate your AI-powered cybersecurity’s ROI

Being a good CLR host – Modernizing offensive .NET tradecraft

The current state of ransomware: Weaponizing disclosure rules and more

Topic updates