Full Report
UEFI copycat of Petya/NotPetya exploiting CVE-2024-7344 discovered on VirusTotal
Analysis Summary
# Vulnerability: HybridPetya Ransomware Utilizing UEFI Secure Boot Bypass (CVE-2024-7344)
## CVE Details
- **CVE ID:** CVE-2024-7344
- **CVSS Score:** Not explicitly stated in the text (Severity derived from context: High/Critical due to Secure Boot bypass)
- **CWE:** UEFI Secure Boot Bypass (**Inferred from context**)
## Affected Systems
- **Products:** Systems utilizing UEFI firmware with Secure Boot enabled on outdated pathways.
- **Versions:** Outdated systems vulnerable to CVE-2024-7344. The specific affected firmware/vendor versions are not listed.
- **Configurations:** Systems where UEFI Secure Boot is enabled but vulnerable to exploitation via a specially crafted `cloak.dat` file loading a malicious EFI application.
## Vulnerability Description
HybridPetya is a Petya/NotPetya copycat malware variant capable of compromising modern UEFI-based systems. It achieves persistence by installing a malicious EFI application onto the EFI System Partition (ESP). Crucially, one analyzed variant exploits **CVE-2024-7344**, a known UEFI Secure Boot bypass vulnerability, to load this malicious bootkit, allowing unsigned code execution high in the boot process. Once executed, the malware encrypts the Master File Table (MFT) on NTFS partitions and reboots the system, displaying fake CHKDSK messages to mask the activity. Unlike NotPetya, HybridPetya appears to permit key reconstruction, suggesting potential ransomware functionality rather than pure destruction.
## Exploitation
- **Status:** **PoC available** (A related public PoC demonstrating UEFI Petya execution with Secure Boot enabled by [@hasherezade](https://x.com/hasherezade/status/1965389009175412769) was noted, though the HybridPetya sample itself has **Not exploited in the wild** according to ESET telemetry).
- **Complexity:** Likely **Medium** or **High** due to the requirement to craft a specific `cloak.dat` file exploiting a complex firmware vulnerability (CVE-2024-7344).
- **Attack Vector:** **Pre-OS Boot** (Bootkit deployment), utilizing initial execution vectors typical of ransomware payloads.
## Impact
- **Confidentiality:** High (MFT encryption leads to inaccessible files)
- **Integrity:** High (Data encryption, modification of boot chain)
- **Availability:** High (System reboot following MFT encryption renders the OS unavailable)
## Remediation
### Patches
- **Official vendor patches for CVE-2024-7344:** The article references the discovery of CVE-2024-7344 earlier in 2025, implying that patches for this underlying vulnerability may be available from firmware vendors. **Specific patch versions are not listed.** Operating systems and firmware owners should apply all available security updates related to UEFI Secure Boot integrity.
### Workarounds
- **Keep UEFI Secure Boot enabled and correctly configured:** Ensure Secure Boot enforcement is active, although this specific malware exploits a flaw in that enforcement mechanism on *outdated* systems.
- **System Updates:** Regularly update all system firmware/BIOS to ensure protection against CVE-2024-7344.
- **Block Malicious Payload Delivery:** Prevent execution of suspicious executables, especially those related to known Petya/NotPetya variants.
## Detection
- **Indicators of Compromise:**
- Presence of a malicious EFI application on the EFI System Partition.
- Appearance of a specially formatted `cloak.dat` file potentially related to the exploit chain.
- System crash initiated via undocumented API `NtRaiseHardError` post-bootkit installation.
- Fake CHKDSK messages displayed during startup/reboot.
- **Detection Methods and Tools:**
- Firmware/UEFI integrity monitoring solutions capable of detecting unauthorized modification to the EFI System Partition.
- Endpoint Detection and Response (EDR) systems monitoring for reflective DLL loading or unusual system reboots/crashes during the boot sequence.
## References
- Vendor Advisories: Not explicitly listed, but the underlying vulnerability CVE-2024-7344 is the primary focus.
- Relevant Links:
- Full ESET Research Article: hxxps://www.welivesecurity.com/en/eset-research/introducing-hybridpetya-petya-notpetya-copycat-uefi-secure-boot-bypass/
- Disclosure of CVE-2024-7344: hxxps://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/
- Related PoC tweet: hxxps://x.com/hasherezade/status/1965389009175412769