As reported by the company's researchers ESET A new threat is coming, this time infecting UEFI firmware. We are dealing with malicious code that survives disk formatting and reinstallation of the operating system and even physical replacement of the hard drive. A more detailed technical description can be found ..
The name "LoJax" given to the new threat is meant to refer to the hardware theft-ready software (LoJack) that inspired the APT28 (Fancy Bear) group known, among other things, for its successful attack on the government's german network (and unauthorized activities lasting about a year).
Since disabling EUFI and reverting to "Legacy BIOS" is not a good proposition, it should now be assumed that any computer that has UEFI mode enabled must run with SecureBoot enabled, as known forms of malicious code are not properly digitally signed (as verified by SecureBoot).
On computers in the first phase of infection (from the operating system to UEFI) there is a driver file RwDrv.sys used to access UEFI settings from the system level. If you format the disk and reinstall the system, you will lose the ability to detect this symptom, but at the same time you will gain nothing - the computer will continue to be infected.
An interesting aspect of the case is that the malware introduced into the operating system connects to special "C&C" servers. Connections to these servers have been discovered, among others, from the government sector of Central European countries, including quite a few connections from Poland, it is reported. Trusted Third Party.
It was also noted that infected motherboards may appear on the secondary market. It will be interesting to see if this "murders" this type of trade, which would make manufacturers happy. It will also come at a good time for antivirus manufacturers - ESET is already promoting its UEFI Scanner, and presumably others will not want to be worse.