Loading malware…
LoJax is a Windows-targeting UEFI firmware rootkit and bootkit publicly identified in 2018 as the first known UEFI rootkit observed in real-world attacks. It has been attributed to the Sednit threat group, also tracked as APT28 or Fancy Bear, and was used in post-compromise espionage operations rather than as a supply-chain implant. LoJax achieves persistence by modifying SPI flash firmware and inserting a malicious DXE driver, commonly identified as SecDxe, allowing execution during the UEFI boot process before the operating system loads. This firmware-level foothold can survive operating system reinstallation and even disk replacement.
The malware’s installation chain includes reconnaissance of firmware protections and abuse of low-level hardware access to dump, modify, and rewrite firmware images. Reporting associates LoJax with reuse of the RWEverything kernel driver for SPI flash access and with targeting systems that lacked proper firmware write protections or had insecure configurations. Multiple analyses describe LoJax as relying on weaknesses in SPI flash write protection, including race-condition-based abuse, and succeeding on systems where Secure Boot was disabled or misconfigured. Its UEFI component has also been reported to reuse an NTFS-capable DXE driver derived from previously leaked code, enabling access to Windows partitions from firmware.
During early boot, the malicious DXE driver drops additional Windows components, including a kernel-mode driver disguised with a non-driver extension and a user-mode service payload. The kernel component prepares persistence for the user-mode agent through Windows startup mechanisms, including modification of BootExecute-related behavior and service-related configuration, after which the user-mode payload operates as a long-lived command-and-control agent. LoJax therefore spans firmware, boot, kernel, and user mode, combining deep persistence with defense evasion and post-compromise control.
LoJax is notable both for its technical significance and for demonstrating that UEFI implants were practical for in-the-wild espionage. It is consistently discussed alongside later firmware threats such as MosaicRegressor, ESPecter, MoonBounce, and TrickBoot as a foundational example of modern firmware-resident persistence.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The same executable disables the BIOS write protections before the firmware modification by just changing the BIOS control register or exploiting known vulnerabilities like VU#766164, CVE-2017-3197 (potentically) if needed. | TAU analyzed the known UEFI bootkit samples in the wild (LoJax, MosaicRegressor, and TrickBoot) and summarized the characteristics... Only LoJax has both.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.
Bootkits usually targeted MBR/ESP in the early 2010s, but as the cost of firmware attack decreased rapidly, the modern bootkits started to target DXE or even PEI.
На данный момент мы можем выделить два вектора атаки на UEFI-платформу: перепрошивка SPI и модификация менеджера загрузки.
The Service Control Manager is not directly abused; instead, it legitimately launches rpcnetp.exe during the normal service startup sequence initiated by wininit.exe, based on service registry configuration prepared earlier by autoche.exe.
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup. ... HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager autocheck autochk *
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
В случае LoJax в основу подхода по компрометации легла эксплуатация уязвимости race condition.
The Service Control Manager is not directly abused; instead, it legitimately launches rpcnetp.exe during the normal service startup sequence initiated by wininit.exe, based on service registry configuration prepared earlier by autoche.exe.
LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk *’ to ‘autocheck autoche *’ in order to execute its payload during Windows startup. ... HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager autocheck autochk *
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
ReSetfTA.efi : UEFI application resetting the infection marker for debug
Чтобы взаимодействовать c PCI-устройством, LoJax использует драйвер в составе утилиты Read & Write Everything ... она имеет подписанный легитимный драйвер, который как раз и использовали разработчики LoJax.
Bootkits are a type of malware that infects the boot process of a computer, allowing attackers to gain persistent access and control over the system.
Bootkits usually targeted MBR/ESP in the early 2010s, but as the cost of firmware attack decreased rapidly, the modern bootkits started to target DXE or even PEI.
Compromising the Management Engine of a system would have considerable value on its own, but the leaks show that the group is using the unique privileges of the ME firmware as a way to gain indirect access to the UEFI/BIOS, drop additional payloads, and gain runtime control of the system below the operating system using System Management Mode (SMM).
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
First UEFI rootkit found in the wild, associated with Sednit/APT28.
A real-world UEFI bootkit discovered in 2018, repurposed from LoJack anti-theft software and installed remotely by overwriting parts of UEFI firmware flash memory.
UEFI-level implant/rootkit that adds a DXE module to firmware for persistence across OS reinstallation and disk replacement, dropping an agent to disk on each boot.
UEFI bootkit referenced as detectable by the Peacock UEFI attestation/monitoring framework; no additional details provided here.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.