A recently discovered ransomware strain called HybridPetya can bypass the UEFI Secure Boot feature to install a malicious application on the EFI System Partition.

HybridPetya appears inspired by the destructive Petya/NotPetya malware that encrypted computers and prevented Windows from booting in attacks in 2016 and 2017 but did not provide a recovery option.

Researchers at cybersecurity company ESET found a sample of HybridPetya on VirusTotal. They note that this may be a research project, a proof-of-concept, or an early version of a cybercrime tool still under limited testing.

Still, ESET says that its presence is yet another example (along with BlackLotus, BootKitty, and Hyper-V Backdoor) that UEFI bootkits with Secure Bypass functionality are a real threat.

HybridPetya incorporates characteristics from both Petya and NotPetya, including the visual style and attack chain of these older malware strains.

However, the developer added new things like installation into the EFI System Partition and the ability to bypass Secure Boot by exploiting the CVE-2024-7344 vulnerability.

ESET discovered the flaw in January this year, The issue consists in Microsoft-signed applications that could be exploited to deploy bootkits even with Secure Boot protection active on the target.

Upon launch, HybridPetya determines if the host uses UEFI with GPT partitioning and drops a malicious bootkit into the EFI System partition consisting of several files.

These include configuration and validation files, a modified bootloader, a fallback UEFI bootloader, an exploit payload container, and a status file that tracks the encryption progress.

ESET lists the following files used across analyzed variants of HybridPetya:

1. \EFI\Microsoft\Boot\config (encryption flag + key + nonce + victim ID)
2. \EFI\Microsoft\Boot\verify (used to validate correct decryption key)
3. \EFI\Microsoft\Boot\counter (progress tracker for encrypted clusters)
4. \EFI\Microsoft\Boot\bootmgfw.efi.old (backup of original bootloader)
5. \EFI\Microsoft\Boot\cloak.dat (contains XORed bootkit in Secure Boot bypass variant)

Also, the malware replaces \EFI\Microsoft\Boot\bootmgfw.efi with the vulnerable ‘reloader.efi,’ and removes \EFI\Boot\bootx64.efi.

The original Windows bootloader is also saved to be activated in the case of successful restoration, meaning that the victim paid the ransom.

Once deployed, HybridPetya triggers a BSOD displaying a bogus error, as Petya did, and forces a system reboot, allowing the malicious bootkit to execute upon system boot.

At this step, the ransomware encrypts all MFT clusters using a Salsa20 key and nonce extracted from the config file while displaying a fake CHKDSK message, like NotPetya.

Once the encryption completes, another reboot is triggered and the victim is served a ransom note during system boot, demanding a Bitcoin payment of $1,000.

In exchange, the victim is provided a 32-character key they can enter on the ransom note screen, which restores the original bootloader, decrypts the clusters, and prompts the user to reboot.

Though HybridPetya has not been observed in any real attacks in the wild, similar projects may choose to weaponize the PoC and use it in broad campaigns targeting unpatched Windows systems at any time.

Indicators of compromise to help defend against this threat have been made available on this GitHub repository.

Microsoft fixed CVE-2024-7344 with the January 2025 Patch Tuesday, so Windows systems that have applied this or later security updates are protected from HybridPetya.

Another solid practice against ransomware is to keep offline backups of your most important data, allowing free and easy system restoration.

Bottom line: As cheating software evolves, so must mitigation efforts. However, new anti-cheat measures rarely go off without a hitch. Many players express concerns about disruptions, false bans, or privacy issues. While no system is perfect, these safeguards are necessary to maintain fair play and preserve the integrity of the game for honest users.

Despite shifting focus to the next Battlefield game, EA continues supporting Battlefield 2042 with updates. The latest patch (8.8.0) now requires Secure Boot to run, a move designed to combat increasingly sophisticated cheating methods and protect fair play.

“As cheat developers keep evolving their tactics, we’re stepping up our game too,” EA said in its Battlefield 2042 changelog.

The change specifically targets cheats that try to load during the Windows boot process. The developers note it only works on hardware supporting Secure Boot, which most rigs do since the feature has existed since 2011. Initially, Microsoft designed Secure Boot to detect low-level malware loading during startup by verifying digital signatures, and it’s had some mishaps in recent years.

Most recently, game developers have used Secure Boot to detect cheaters. Valorant was among the first to implement these checks, with mixed results. The anti-cheat method generally worked as intended, but many users reported it bricking their game. Whether all those reports were honest is unclear – cheaters often lie to regain access. However, even a small percentage of legitimate players getting cut off or banned due to technical issues doesn’t sit well with the community.

Several controversial anti-cheat clashes have flared up, especially over demands for kernel-level access. Valorant’s Vanguard system requires Ring 0 privileges, but it’s not just Riot Games and EA caught in the crossfire. Most major multiplayer games, including Fortnite, use invasive anti-cheat software. It’s a price players pay to enjoy these games – without it, cheating runs rampant and ruins the experience for everyone.

Even with mitigation methods in place, developers still struggle with the problem. Last year, cheaters disrupted the Apex Legends Global Series. At least two contestants suddenly found themselves using cheats they didn’t install. Ironically, outside hackers had taken over their computers. Officials subsequently postponed the event while operators secured the servers.

While new anti-cheat measures may frustrate some legitimate players, developers must prioritize protecting gameplay for the good of the community. Most players with Secure Boot enabled in other games experience no issues, and any hiccups tend to affect only a small fraction of the gaming population.

Most modern systems ship with Secure Boot enabled by default, but Battlefield will display a popup if it isn’t. Players unfamiliar with tinkering with BIOS settings can find step-by-step instructions on EA’s help pages or check out the video above.

Microsoft has begun testing a new Windows 11 tool called Quick Machine Recovery, which is designed to remotely deploy fixes for buggy drivers and configurations that prevent the operating system from starting.

The tool is part of Microsoft’s Windows Resiliency Initiative, an effort to enhance system stability and reduce downtime by introducing automated tools and features to detect, diagnose, and fix critical failures in Windows 11.

“With system failures, devices can sometimes get stuck in the Windows Recovery Environment (Windows RE), severely impacting productivity and often requiring IT teams to spend significant time troubleshooting and restoring affected machines,” explains Microsoft.

“With quick machine recovery, when a widespread outage affects devices from starting properly, Microsoft can broadly deploy targeted remediations to affected devices via Windows RE—automating fixes and quickly getting users to a productive state without requiring complex manual intervention.”

On Friday, Microsoft released the Quick Machine Recovery to Windows Insider Preview Beta Channel, so Insiders can start testing the tool.

When enabled and a new driver or configuration change prevents Windows 11 from properly starting, the operating system will boot into the Windows Recovery Environment and automatically launch the Quick Machine Recovery Tool.

This tool will connect to the Internet through ethernet or Wi-Fi and send crash data to Microsoft’s servers. Based on the analysis of this data, Microsoft can remotely apply fixes such as removing problematic drivers or updates and changing configuration settings.

This new tool comes in response to the faulty CrowdStrike update that caused millions of Windows devices worldwide to suddenly crash with a Blue Screen of Death (BSOD) and enter reboot loops in July 2024.

To remove the bad update, Windows admins were forced to boot into the Windows Recovery Environment or Safe Mode and manually delete the driver so their Windows devices could boot normally.

With a tool like Quick Machine Recovery, Microsoft could have pushed out a fix that removed the driver and brought machines back online far more easily and quickly.

Microsoft says this feature will eventually be enabled by default in Windows 11 Home. The enterprise will be able to customize how the tool works in Windows 11 Pro and Enterprise through RemoteRemedation CSP or directly on the device via reagentc.exe.

The tool can also be preconfigured with network credentials to make it easier to deploy fixes and configure how often problematic PCs reach out to Microsoft’s servers for a fix.

Microsoft will release a test remediation package in a few days, allowing Insiders to test the feature live.