For the first time ever, researchers discovered a Unified Extensible Firmware Interface (UEFI) rootkit in the wild that they believe the Sednit advanced persistent threat (APT) group used to execute LoJax malware.

Researchers at ESET observed an attack campaign distributing LoJax and three types of tools. The first component dumped system information into a text file. The second tool read the contents of the Serial Peripheral Interface (SPI) flash memory to save an image of the system’s firmware. The third wrote a UEFI module to the SPI flash memory and installed a UEFI rootkit that’s responsible for dropping LoJax onto the machine.

All Signs Point to Sednit

LoJax is a Trojanized version of LoJack, antitheft software that uses a UEFI and Basic Input/Output System (BIOS) module to help it resist operating system (OS) reinstallations and hard drive replacements. LoJax uses this same persistence method but calls to a malicious command-and-control (C&C) server.

ESET recognized some of the domains used by LoJax as those employed by SedUploader, the first-stage backdoor of Sednit. This discovery, along with other evidence, led ESET to attribute the campaign and UEFI rootkit to the APT group.

The UEFI rootkit used to distribute LoJax may be the first of its kind discovered in the wild, but researchers have uncovered others like it outside of active attack campaigns. Back in 2015, McAfee found a UEFI-based rootkit in the Hacking Team data breach. Individuals have also disclosed proof-of-concept UEFI rootkits on YouTube.

How to Defend Against LoJax Malware and UEFI Rootkits

According to ESET, organizations can defend themselves against LoJax malware and UEFI rootkits by enabling Secure Boot. The researchers also urged security teams to use the latest UEFI/BIOS available for their motherboard. Updating UEFI/BIO can result in performance degradation, so security professionals should consult their application vendors to determine the potential impact to their environments.

Sources: ESET, McAfee, YouTube