HOMETHREATSLoJax
APT / THREAT GROUP

LoJax

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.lojax

Threat Analysis

LoJax is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blogs.vmware.com/security/2021/06/detecting-uefi-bootkits-in-the-wild-part-1.html
→https://habr.com/ru/amp/post/668154/
→https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government
→https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf
→https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

LoJaxwin.lojax

External Intelligence

Malpedia: win.lojax

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search LoJax