Windows 10: ESET discovers first LoJax UEFI rootkit malware by Sednit group

Brink · Sep 27, 2018

UEFI rootkits are widely viewed as extremely dangerous tools for implementing cyberattacks, as they are hard to detect and able to survive security measures such as operating system reinstallation and even a hard disk replacement. Some UEFI rootkits have been presented as proofs of concept; some are known to be at the disposal of (at least some) governmental agencies. However, no UEFI rootkit has ever been detected in the wild – until we discovered a campaign by the Sednit APT group that successfully deployed a malicious UEFI module on a victim’s system.

The discovery of the first in-the-wild UEFI rootkit is notable for two reasons.

First, it shows that UEFI rootkits are a real threat, and not merely an attractive conference topic.

And second, it serves as a heads-up, especially to all those who might be in the crosshairs of Sednit. This APT group, also known as APT28, STRONTIUM, Sofacy and Fancy Bear, may be even more dangerous than previously thought.

Our analysis of the Sednit campaign that uses the UEFI rootkit was presented September 27 at the 2018 Microsoft BlueHat conference and is described in detail in our “LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group” white paper. In this blog post, we summarize our main findings.

The Sednit group has been operating since at least 2004, and has made headlines frequently in past years: it is believed to be behind major, high profile attacks. For instance, the US Department of Justice named the group as being responsible for the Democratic National Committee (DNC) hack just before the US 2016 elections. The group is also presumed to be behind the hacking of global television network TV5Monde, the World Anti-Doping Agency (WADA) email leak, and many others. This group has a diversified set of malware tools in its arsenal, several examples of which we have documented previously in our Sednit white paper from 2016.

Our investigation has determined that this malicious actor was successful at least once in writing a malicious UEFI module into a system’s SPI flash memory. This module is able to drop and execute malware on disk during the boot process. This persistence method is particularly invasive as it will not only survive an OS reinstall, but also a hard disk replacement. Moreover, cleaning a system’s UEFI firmware means re-flashing it, an operation not commonly done and certainly not by the typical user.

Our research has shown that the Sednit operators used different components of the LoJax malware to target a few government organizations in the Balkans as well as in Central and Eastern Europe...
Click to expand...

Read more: LoJax: First UEFI rootkit found in the wild, courtesy of the Sednit group

Downlaod research paper (PDF): https://www.welivesecurity.com/wp-co...ESET-LoJax.pdf

Tweet

— Twitter API (@user) View on Twiiter

:)

Darkgundam111 · Sep 27, 2018

malware program supplement eset??

I heard that eset is not that great as it used to be compared to the other paid solutions. More specifically their malware protection is lacking. Should I get a malware protector on top of it? if so which one?

Jsssssssss · Sep 27, 2018

Rootkits.... Questions

Suggestion to do some reading:

What is a rootkit?

https://www.microsoft.com/en-us/wdsi/threats/rootkits

Glossary of Malware Related Terms

Best Practices for Safe Computing - Prevention of Malware Infection

Bree · Sep 27, 2018

Windows Defender for Win10 v1709 and Rootkits?

So just to confirm, that this Offline scans do detect Rootkits if discovered, is this correct?
Click to expand...

Windows Defender can detect rootkits, then tell you to run Defender Offline to remove them.

Run Windows Defender Offline if:

Windows Defender detects rootkits or other highly persistent malware on your PC and alerts you to use Windows Defender Offline...

Click to expand...

https://support.microsoft.com/en-gb/...-protect-my-pc

Windows 10: ESET discovers first LoJax UEFI rootkit malware by Sednit group

ESET discovers first LoJax UEFI rootkit malware by Sednit group

ESET discovers first LoJax UEFI rootkit malware by Sednit group

ESET discovers first LoJax UEFI rootkit malware by Sednit group

ESET discovers first LoJax UEFI rootkit malware by Sednit group - Similar Threads - ESET discovers LoJax

undetected UEFI rootkit

undetected UEFI rootkit

Unable to discover Malware on NTFS HDD

Unable to discover Malware on NTFS HDD

rootkit

Can I remove a RootKit malware?

Huge Android trojan malware campaign was discovered

malware and malwarebytes beta rootkit

Malware/eset