HYBRIDPETYA RANSOMWARE BYPASSES UEFI SECURE BOOT ECHOING PETYA/NOTPETYA

Summary from the TLDR InfoSec newsletter

The HybridPetya ransomware on VirusTotal echoes the infamous Petya/NotPetya attacks but adds UEFI bootkit capabilities and exploits CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems. Unlike NotPetya, HybridPetya functions as actual ransomware with decryption capabilities, encrypting the Master File Table after compromising EFI partitions and displaying fake CHKDSK status before showing ransom demands. This marks the fourth known UEFI bootkit with Secure Boot bypass capability, joining BlackLotus, BootKitty, and the Hyper-V Backdoor PoC, indicating these sophisticated attacks are becoming more common.