LoJax: First UEFI rootkit found in the wild

LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

https://www.welivesecurity.com/2018/09/...

Our investigation has determined that this malicious actor was successful at least once in writing a malicious UEFI module into a system’s SPI flash memory. This module is able to drop and execute malware on disk during the boot process. This persistence method is particularly invasive as it will not only survive an OS reinstall, but also a hard disk replacement. Moreover, cleaning a system’s UEFI firmware means re-flashing it, an operation not commonly done and certainly not by the typical user.

Our research has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe.

+ The Register:

https://www.theregister.co.uk/2018/09/2...