HybridPetya: A Bootkit-Enabled Ransomware Threat

HybridPetya Ransomware: Secure Boot Bypass and MFT Encryption Threat

Summary

HybridPetya is a new ransomware strain first observed in February 2025 that combines features of Petya and NotPetya while adding modern attack capabilities. This ransomware targets Windows systems by encrypting the Master File Table (MFT), effectively preventing access to files, and uniquely, it can bypass UEFI Secure Boot protections by exploiting CVE-2024-7344.

Once deployed, HybridPetya installs a malicious bootkit into the EFI System Partition, forces a reboot, disguises encryption as a fake CHKDSK process, and presents a Bitcoin ransom note. Unlike NotPetya, which acted as a wiper, HybridPetya supports genuine decryption if the ransom is paid. Although it has not been widely deployed, its ability to bypass Secure Boot poses a significant emerging threat for even well-secured enterprise environments.

Attack Details

HybridPetya infection begins by writing its components to the EFI System Partition and exploiting CVE-2024-7344 to bypass Secure Boot protections. After installation, it forces a reboot and executes pre-OS, encrypting the MFT before Windows loads. The fake CHKDSK screen is used to mask encryption activity.

Upon completion, victims are shown a ransom note at boot, instructing them to pay in Bitcoin to receive a decryption key. If the correct key is provided, HybridPetya restores the original bootloader and decrypts the system, allowing normal use.

So far, HybridPetya is primarily seen in limited samples and testing, not in widespread attacks, but its combination of boot-level compromise and true ransomware functionality suggests it could cause devastating enterprise-scale incidents if weaponized.

Recommendations

• Apply Security Updates: Install Microsoft’s Secure Boot revocation updates (January 2025 and later), which revoke vulnerable UEFI components affected by CVE-2024-7344. Keep UEFI firmware updated across all systems.

• Harden Boot Security: Ensure Secure Boot is enabled and correctly configured. Regularly monitor the EFI System Partition for unauthorized changes (e.g., modified bootloaders, suspicious files like config, verify, cloak.dat).

• Maintain Reliable Backups: Regularly back up critical data and systems, store backups securely offline, and test restoration procedures to ensure integrity. In case of a HybridPetya infection, backups enable recovery without paying ransom.

• Enhance Detection and Monitoring: Deploy endpoint protection and EDR solutions capable of detecting bootloader tampering and ransomware behavior. Implement file integrity monitoring for \EFI\Microsoft\Boot and watch for unusual reboots, fake CHKDSK screens, or ransom notes.

Indicators of Compromise (IoCs)

SHA1 Hashes

• BD35908D5A5E9F7E41A61B7AB598AB9A88DB723D

• 9DF922D00171AA3C31B75446D700EE567F8D787B

• 9B0EE05FFFDA0B16CF9DAAC587CB92BB06D3981B

• CDC8CB3D211589202B49A48618B0D90C4D8F86FD

• D31F86BA572904192D7476CA376686E76E103D28

• A6EBFA062270A321241439E8DF72664CD54EA1BC

• C8E3F1BF0B67C83D2A6D9E594DE8067F0378E6C5

• C7C270F9D3AE80EC5E8926A3CD1FB5C9D208F1DC

• 3393A8C258239D6802553FD1CCE397E18FA285A1

• 98C3E659A903E74D2EE398464D3A5109E92BD9A9

• D0BD283133A80B47137562F2AAAB740FA15E6441

File Names

• bootmgfw.efi

• core.dll

• f20000.mbam_update.exe

• improved_notpetyanew.exe

• notpetya_new.exe

• notpetyanew.exe

• notpetyanew_improved_final.exe

• cloak.dat

MITRE ATT&CK TTPs

• Execution: T1059 (Command and Scripting Interpreter), T1203 (Exploitation for Client Execution)

• Persistence: T1542 (Pre-OS Boot), T1542.003 (Bootkit)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation), T1574 (Hijack Execution Flow)

• Defense Evasion: T1036 (Masquerading), T1027 (Obfuscated Files/Information), T1211 (Exploitation for Defense Evasion), T1620 (Reflective Code Loading)

• Impact: T1486 (Data Encrypted for Impact), T1529 (System Shutdown/Reboot)

• Discovery & Preparation: T1587 (Develop Capabilities), T1587.001 (Malware), T1588 (Obtain Capabilities)

• Persistence/Stealth: T1564 (Hide Artifacts), T1564.004 (NTFS File Attributes)

References

• ESET – HybridPetya Secure Boot Bypass Analysis

• UEFI Revocation List

• Microsoft CVE-2024-7344 Advisory