LoJax

ATP Sandbox Adv. HeuristicsAV

Description

LoJax is a UEFI rootkit used by APT28 to persist remote access software on targeted systems, making it one of the first UEFI rootkits observed in the wild.

Stats

First seen: April 2022
Last seen: October 2026

Also known as

Lojax

MITRE ATT&CK techniques

5 techniques across 3 tactics.

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1014Rootkit
T1542Pre-OS Boot
- T1542.001System Firmware
T1564Hide Artifacts
- T1564.004NTFS File Attributes

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0007APT28

Alert name variants

Alert Name	Engine
Trojan.EFI.LoJax.36859417	AV
Trojan.LoJax.2	AV
Win32.Backdoor.Lojax	ATP Sandbox Adv. Heuristics
Win32.Backdoor.LoJax	ATP Sandbox Adv. Heuristics
Win32.Rootkit.LoJax	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Lojax	ATP Sandbox Adv. Heuristics
Win64.Backdoor.LoJax	ATP Sandbox Adv. Heuristics
Win64.Trojan.Lojax	ATP Sandbox Adv. Heuristics

Related families

PoisonIvy WarzoneRAT BitPaymer Agent Tesla Bisonal

References