New HybridPetya Ransomware Bypasses UEFI Secure Boot With CVE-2024-7344 Exploit

Cybersecurity researchers have identified a new ransomware variant called HybridPetya that mirrors Petya/NotPetya while adding the ability to bypass UEFI Secure Boot using CVE-2024-7344, a vulnerability now patched by Microsoft’s January 2025 updates. Slovakian firm ESET said samples were uploaded to VirusTotal in February 2025, and according to ESET, HybridPetya encrypts the Master File Table (MFT) and can compromise modern UEFI-based systems by installing a malicious EFI application onto the EFI System Partition.

The threat comprises a bootkit and an installer, with the bootkit managing encryption status and deploying a file counter to track encrypted disk clusters, and it displays a manipulated CHKDSK message to mislead victims. If encryption is active, the ransomware demands $1,000 in Bitcoin to a specified wallet address, which has received small sums since February 2025, and the decryption flow involves loading the embedded UEFI application from cloak.dat and attempting to decrypt the disk.

The technique relies on executing reloader[.]efi during boot to bypass Secure Boot, and experts note HybridPetya represents a further example of real or PoC UEFI bootkits with Secure Boot bypass capabilities.