LoJax (Sednit / APT28)

Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.

2 syscalls cited

NtQuerySystemEnvironmentValueEx
Reads a UEFI variable identified by a (name, vendor GUID) pair and returns its data plus attributes.
NtSetSystemEnvironmentValueEx
Writes or deletes a UEFI variable identified by (name, vendor GUID) — the canonical firmware-persistence surface.