HybridPetya Exploits UEFI Vulnerability to Bypass Secure Boot on Legacy Systems

According to ESET Research, a ransomware variant named HybridPetya has been uncovered that exploits a UEFI vulnerability to bypass Secure Boot on legacy systems, using CVE-2024-7344 to defeat protections. The malware installs a malicious EFI application directly onto the EFI System Partition, giving attackers control over the boot process and enabling low-level operation that evades many standard security tools.

HybridPetya’s approach includes exploiting a cloak.dat file to circumvent Secure Boot on older systems that have not received Microsoft’s January 2025 security updates, and it has been linked to the notpetya/NotPetya lineage while presenting its own destructive encryption behaviour. The samples were uploaded to VirusTotal in February 2025 from Poland, with filenames such as “notpetyanew.exe”, and the encryption targets the Master File Table on NTFS partitions using the Salsa20 algorithm.

ESET telemetry indicates the campaign is not currently active, suggesting it may be in development or proof-of-concept stages, though researchers warn that UEFI Secure Boot bypass capabilities are increasingly attractive to threat actors.