ESET Research has uncovered a sophisticated new ransomware variant called HybridPetya, discovered on the VirusTotal sample sharing platform. This malware represents a dangerous evolution of the infamous Petya/NotPetya ransomware family, incorporating advanced capabilities to compromise UEFI-based systems and exploit CVE-2024-7344 to bypass UEFI Secure Boot protections on vulnerable systems. Unlike its predecessors, HybridPetya demonstrates significant […]
In late July 2025, a series of ransomware samples surfaced on VirusTotal under filenames referencing the notorious Petya and NotPetya attacks.
Unlike its predecessors, this new threat—dubbed HybridPetya by ESET analysts—exhibited capabilities that extended beyond conventional userland execution, directly targeting UEFI firmware on vulnerable systems.
Through a specially crafted cloak.dat archive and the exploitation of CVE-2024-7344, HybridPetya achieves a Secure Boot bypass on outdated platforms, allowing it to install a malicious EFI application into the EFI System Partition.
HybridPetya’s emergence marks a significant evolution in bootkit design. The malware leverages a dual-component architecture: a Windows-based installer and an EFI bootkit.
Upon deployment, the installer locates the EFI System Partition, backs up legitimate bootloaders, drops a Salsa20-encrypted configuration file (\EFI\Microsoft\Boot\config), and plants an encrypted verification array (\EFI\Microsoft\Boot\verify).
Overview of HybridPetya’s execution logic (Source – Welivesecurity)
A triggered BSOD then forces the system to reload through the compromised bootloader, activating the EFI component at next startup.
ESET researchers identified that HybridPetya supports both legacy and UEFI systems; however, its true innovation lies in bypassing UEFI Secure Boot via the CVE-2024-7344 vulnerability.
In affected systems lacking Microsoft’s January 2025 dbx update, the malicious reloader.efi application masquerades as a trusted Microsoft-signed binary.
When executed, it treats the accompanying cloak.dat file as a legitimate payload, loading and executing the XOR-obfuscated EFI bootkit without signature verification.
Hex-Rays decompiled code for NTFS partition identification (Source – Welivesecurity)
This technique mirrors the exploitation method detailed by ESET in earlier advisory reports, albeit weaponized within a ransomware framework.
Once the EFI bootkit gains control during the pre-OS phase, it reads its configuration and encryption flag.
If the flag is set to “ready for encryption,” the bootkit extracts the Salsa20 key and nonce, rewrites the configuration flag, and encrypts the NTFS Master File Table (MFT) on all detected partitions.
During this process, a deceptive CHKDSK-like progress message is displayed to the victim, masking the malicious activity.
Fake CHKDSK message shown by HybridPetya during disk encryption (Source – Welivesecurity)
After encryption completes, the system reboots, presenting a NotPetya-style ransom note.
Infection Mechanism and Persistence
HybridPetya’s infection mechanism hinges on the interplay between its Windows installer and UEFI bootkit.
The installer begins by calling the native API NtRaiseHardError to induce a shutdown, ensuring the malicious bootloader will execute on restart:-
This crash trick guarantees that the UEFI component runs under Secure Boot enforcement—or, in the case of outdated systems, bypassed Secure Boot.
Upon reboot, the EFI application locates \EFI\Microsoft\Boot\config, examines the encryption flag, and branches into encryption or decryption logic.
For decryption, the victim must input a 32-character key; the EFI bootkit then decrypts the verify file and, if the plaintext matches a series of 0x07 bytes, proceeds to restore the MFT and legitimate bootloaders from their .old backups.
By embedding this persistence directly into the firmware layer, HybridPetya ensures the ransomware cannot be removed by standard OS-level remediation tools, elevating its resilience and framing it as a milestone in firmware-targeted threats.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
Microsoft has released security advisories for four newly discovered vulnerabilities in its Windows Defender Firewall Service that could enable attackers to elevate privileges on affected Windows systems. The flaws, tracked as CVE-2025-53808, CVE-2025-54104, CVE-2025-54109, and CVE-2025-54915, were all disclosed on September 9, 2025, and share similar characteristics. While exploitation requires local access, successful attacks could […]
EvilAI, a new malware family tracked by Trend™ Research, has emerged in recent weeks disguised as legitimate AI-driven utilities. These trojans sport professional user interfaces, valid code signatures, and functional features, allowing them to slip past both corporate and personal defenses undetected. Leveraging lightweight installers and AI-generated code, EvilAI rapidly establishes persistent footholds while masquerading […]
In 2025, the cybersecurity landscape is defined by its complexity and the speed of modern threats. Security teams are overwhelmed by a fragmented array of security controls and a lack of clear visibility into what’s actually working. Breach and Attack Simulation (BAS) platforms solve this problem by continuously and safely validating security defenses against real-world […]
Cybersecurity researchers have discovered a new ransomware strain dubbed HybridPetya that resembles the notorious Petya/NotPetya malware, while also incorporating the ability to bypass the Secure Boot mechanism in Unified Extensible Firmware Interface (UEFI) systems using a now-patched vulnerability disclosed earlier this year.
Slovakian cybersecurity company ESET said the samples were uploaded
The Cybersecuritynews researcher team uncovered a sophisticated social engineering campaign that is exploiting the public’s need for free internet access, using deceptive Wi-Fi portals to trick users into downloading and executing PowerShell-based malware.
Dubbed the “Clickfix” attack, this method turns a user’s own browser actions against them to compromise their system under the guise of a simple human verification step.
The attack targets on individuals in public spaces like airports, where the promise of “Free Wi-Fi” is a powerful lure. Unsuspecting users attempting to connect are redirected to a professionally designed but fake captive portal.
These pages, often hosted on insecure IP addresses rather than legitimate domains, mimic real network login screens, complete with logos and a CAPTCHA prompt to “prove you are not a robot,” a feature intended to build a false sense of security.
Deceptive Verification Process
The core of the Clickfix attack lies in its clever manipulation of user behavior. After a user interacts with the fake CAPTCHA, a pop-up window appears with a set of “Verification Steps.”
Instead of a simple click, the instructions guide the user through a specific sequence of keyboard shortcuts: press Ctrl+S to save the web page, navigate to the browser’s downloads window, and press Enter to open the file, the Cybersecuritynews researcher team said.
This sequence is a social engineering trick designed to bypass standard browser security warnings about downloading executable files.
By instructing the user to save the page and run the file themselves, the attackers effectively get consent to execute malicious code. The downloaded file is not an image or document but a script that initiates the infection.
Once the user unwittingly executes the downloaded file, a malicious PowerShell script is launched.
Analysis of the attack chain with ANY.RUN Sandbox reveals that this script acts as a downloader, establishing a connection to a command-and-control server to fetch the primary malware payload. In this campaign, the payload has been identified as a network trojan.
PowerShell is a powerful tool for attackers because it is integrated into Windows and can execute commands, scripts, and payloads directly in memory, often evading detection by traditional antivirus solutions.
This type of fileless malware can be used for a wide range of malicious activities, including stealing sensitive information, deploying ransomware, or providing a persistent backdoor for remote access to the compromised device.
To safeguard against this threat, users should stay alert when connecting to public Wi-Fi, carefully examine the URLs of login pages, and be very cautious of any website that requires unusual keyboard commands for verification.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
A malicious ISO image named Servicenow-BNM-Verify.iso was uploaded to VirusTotal from Malaysia with almost no detections. The image contains four files—two openly visible and two hidden. The visible files include a Windows shortcut, servicenow-bnm-verify.lnk, which launches PanGpHip.exe, a legitimate Palo Alto Networks binary. Hidden in the same ISO are libeay32.dll, a genuine OpenSSL library, and […]
A sophisticated malvertising campaign has been uncovered targeting unsuspecting users through “dangling commits” in a legitimate GitHub repository. Attackers are injecting promotional content for a counterfeit GitHub Desktop installer into popular development and open-source projects. When users download what appears to be the genuine client, the installer quietly delivers malicious payloads in the background, compromising […]
A new kernel address leak vulnerability has been discovered in the latest versions of Windows 11 (24H2) and Windows Server 2022 (24H2).
The flaw, identified as CVE-2025-53136, was ironically introduced by a Microsoft patch intended to fix a separate vulnerability, CVE-2024-43511.
According to Crowdfense, the new bug undermines recent security enhancements in Windows, providing a reliable method for attackers to bypass Kernel Address Space Layout Randomization (KASLR), a critical defense mechanism.
In recent updates, particularly starting with the 24H2 versions of Windows 11 and Windows Server 2022, Microsoft took significant steps to harden the operating system kernel against attacks.
The company restricted access to kernel base addresses by limiting functions like NtQuerySystemInformation().
This change meant that only highly privileged processes could retrieve this information, effectively neutralizing a common technique used by attackers to bypass KASLR and making it much harder to exploit kernel vulnerabilities.
However, analysis of the October 2024 patch for CVE-2024-43511, a Time-of-check Time-of-use (TOCTOU) race condition vulnerability, revealed a critical error.
In fixing the original bug, developers modified the RtlSidHashInitialize() function. The new code temporarily writes a sensitive kernel pointer from the TOKEN structure into a user-controlled buffer.
Although the pointer is quickly removed, it creates a small but exploitable time window for an attacker to read it.
Exploiting The Race Condition
An attacker can trigger this vulnerability by making a specific system call (NtQueryInformationToken() with the TokenAccessInformation class) while simultaneously running a separate thread to read the memory location where the kernel address is briefly leaked.
Despite being a race condition, the time window is reportedly wide enough to make the exploit highly reliable. A proof-of-concept demonstrates that the leaked TOKEN address can be obtained almost every time the exploit is run, Crowdfense added.
The impact is significant because this leak works on the latest, fully patched versions of Windows 11 and can be executed from low-privilege environments, including sandboxed AppContainer applications. While the vulnerability itself only leaks information, it serves as a powerful primitive.
When chained with a separate bug, such as a “write-what-where” condition, an attacker could achieve a full Local Privilege Escalation (LPE) by overwriting the Privileges field of the TOKEN object.
This discovery highlights a common challenge in software security: fixing one vulnerability can sometimes inadvertently create another. The researcher who discovered the flaw followed a responsible disclosure process, which began on April 8, 2025.
After some initial confusion where the report was mistakenly closed as a duplicate, Microsoft eventually acknowledged the new, valid bug on April 25 and assigned it CVE-2025-53136 in August.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
.webp)
.webp)
.webp)
