HybridPetya ransomware bypasses UEFI Secure Boot echoing Petya/NotPetya

HybridPetya ransomware bypasses UEFI Secure Boot to infect EFI partitions, echoing the Petya/NotPetya attacks of 2016–2017, according to ESET. Researchers discovered the new malware on VirusTotal, and it exploits CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems. The UEFI bootkit has two similar versions and, on execution, checks an encryption flag in a config file, then encrypts the Master File Table and associated data before rebooting to present a ransom note if the disk is already encrypted.

The installers locate the EFI System Partition on GPT disks, drop an encryption config containing the Salsa20 key and nonce, and replace the boot flow by backing up bootmgfw[.]efi and forcing a reboot into the modified boot sequence. Unlike NotPetya, HybridPetya acts as true ransomware like Petya, though researchers suspect the sample could be linked to a UEFI Petya PoC discussed on 9 September 2025, suggesting it may be a research project.

The analysis notes that HybridPetya’s bootkit and installer demonstrate substantial capabilities, including MFT encryption, UEFI compatibility, and Secure Boot bypass, making it noteworthy for future threat monitoring.