HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344

In September 2025, researchers at ESET identified a new ransomware variant named HybridPetya that combines destructive Petya/NotPetya traits with advanced UEFI attack capabilities. Leveraging the CVE-2024-7344 vulnerability, attackers were able to bypass UEFI Secure Boot, allowing the malware to execute at a privileged level prior to OS load. Initial infection vectors appear to include phishing emails and software supply-chain compromises, leading to widespread disruption of targeted organizations’ endpoints, encrypted data, and in some instances, bricked devices. The attack highlights a disturbing escalation in ransomware sophistication and targeting, with significant operational downtime and financial losses reported in affected sectors.

HybridPetya represents an evolution in ransomware, merging firmware exploitation with traditional payload delivery to maximize impact. This incident underscores the expanding threat landscape as adversaries weaponize newly discovered vulnerabilities and aim higher up the trust chain, intensifying pressure on organizations to harden their endpoints and update defenses in real time.

HybridPetya’s exploitation of a recently disclosed UEFI Secure Boot vulnerability demonstrates how quickly threat actors can operationalize zero-days for impactful attacks. With ransomware campaigns now targeting firmware, the risks to business continuity, data integrity, and regulatory compliance are more urgent than ever—prompting immediate attention to update, monitor, and segment all enterprise assets.