What is the name of a UEFI rootkit that is widely used by attackers to inject malware and automatically execute when the system starts up?

• A. Stuxnet
• B. LoJax
• C. Necurs
• D. Shamoon

Answer: (B)

Firmware-level persistence is achieved by targeting the system’s firmware so code runs before the operating system and can survive OS reinstalls. LoJax is a well-known UEFI rootkit that exemplifies this technique, having been discovered as a malicious component implanted in the UEFI firmware to load at boot and inject additional malware. Because it resides in the firmware, it can automatically execute during startup and remain persistent across reboots and OS changes, making detection and removal much harder than standard, OS-level infections. The other threats operate at different layers or targets—one aims at industrial control systems, another is a mass-infection botnet, and the last is a destructive wiper—so they don’t fit the boot-time, firmware-level persistence profile of a UEFI rootkit like LoJax.