A recently discovered ransomware strain called HybridPetya can bypass the UEFI Secure Boot feature to install a malicious application on the EFI System Partition.

HybridPetya appears inspired by the destructive Petya/NotPetya malware that encrypted computers and prevented Windows from booting in attacks in 2016 and 2017 but did not provide a recovery option.

Researchers at cybersecurity company ESET found a sample of HybridPetya on VirusTotal. They note that this may be a research project, a proof-of-concept, or an early version of a cybercrime tool still under limited testing.

Still, ESET says that its presence is yet another example (along with BlackLotus, BootKitty, and Hyper-V Backdoor) that UEFI bootkits with Secure Bypass functionality are a real threat.

HybridPetya incorporates characteristics from both Petya and NotPetya, including the visual style and attack chain of these older malware strains.

However, the developer added new things like installation into the EFI System Partition and the ability to bypass Secure Boot by exploiting the CVE-2024-7344 vulnerability.

ESET discovered the flaw in January this year, The issue consists in Microsoft-signed applications that could be exploited to deploy bootkits even with Secure Boot protection active on the target.

Upon launch, HybridPetya determines if the host uses UEFI with GPT partitioning and drops a malicious bootkit into the EFI System partition consisting of several files.

These include configuration and validation files, a modified bootloader, a fallback UEFI bootloader, an exploit payload container, and a status file that tracks the encryption progress.

ESET lists the following files used across analyzed variants of HybridPetya:

1. \EFI\Microsoft\Boot\config (encryption flag + key + nonce + victim ID)
2. \EFI\Microsoft\Boot\verify (used to validate correct decryption key)
3. \EFI\Microsoft\Boot\counter (progress tracker for encrypted clusters)
4. \EFI\Microsoft\Boot\bootmgfw.efi.old (backup of original bootloader)
5. \EFI\Microsoft\Boot\cloak.dat (contains XORed bootkit in Secure Boot bypass variant)

Also, the malware replaces \EFI\Microsoft\Boot\bootmgfw.efi with the vulnerable ‘reloader.efi,’ and removes \EFI\Boot\bootx64.efi.

The original Windows bootloader is also saved to be activated in the case of successful restoration, meaning that the victim paid the ransom.

Once deployed, HybridPetya triggers a BSOD displaying a bogus error, as Petya did, and forces a system reboot, allowing the malicious bootkit to execute upon system boot.

At this step, the ransomware encrypts all MFT clusters using a Salsa20 key and nonce extracted from the config file while displaying a fake CHKDSK message, like NotPetya.

Once the encryption completes, another reboot is triggered and the victim is served a ransom note during system boot, demanding a Bitcoin payment of $1,000.

In exchange, the victim is provided a 32-character key they can enter on the ransom note screen, which restores the original bootloader, decrypts the clusters, and prompts the user to reboot.

Though HybridPetya has not been observed in any real attacks in the wild, similar projects may choose to weaponize the PoC and use it in broad campaigns targeting unpatched Windows systems at any time.

Indicators of compromise to help defend against this threat have been made available on this GitHub repository.

Microsoft fixed CVE-2024-7344 with the January 2025 Patch Tuesday, so Windows systems that have applied this or later security updates are protected from HybridPetya.

Another solid practice against ransomware is to keep offline backups of your most important data, allowing free and easy system restoration.

Cutting corners: A sophisticated spam campaign leveraging GenAI’s large language models has targeted tens of thousands of websites, revealing the darker side of LLMs. According to a detailed report by SentinelLabs, the framework behind this operation, dubbed AkiraBot, has successfully bypassed spam detection filters, delivering AI-generated messages to over 80,000 websites in just four months.

AkiraBot is a Python-based framework that exploits website contact forms and live chat widgets, primarily targeting small and medium-sized businesses. Its goal is to promote questionable search engine optimization services under the brands “Akira” and “ServiceWrap.”

Unlike traditional spam tools that rely on repetitive templates, AkiraBot uses OpenAI’s chat API to generate unique messages tailored to each targeted website. It crafts personalized content using site-specific details scraped with BeautifulSoup, making the messages more difficult for spam filters to detect.

The framework’s modular design includes advanced CAPTCHA bypass mechanisms and network evasion techniques. It uses Selenium WebDriver to simulate legitimate browsing behavior, along with scripts like inject.js to manipulate browser attributes such as graphics rendering, installed fonts, and system memory profiles.

Annoying CAPTCHAs… because selecting blurry traffic lights, deciphering distorted text, and proving you’re not a robot is apparently the ultimate test of humanity.

These modifications allow AkiraBot to mimic real user behavior, defeating CAPTCHA systems like hCAPTCHA and reCAPTCHA. Additionally, it relies on proxy services like SmartProxy to diversify traffic sources and evade IP-based restrictions.

SentinelLabs uncovered archives dating back to September 2024 that document AkiraBot’s evolution. Initially referred to as “Shopbot,” the framework expanded its targeting from Shopify-based websites to platforms like GoDaddy, Wix, Squarespace, and others commonly used by small businesses.

The bot’s graphical user interface allows operators to monitor success metrics and adjust settings for concurrently targeting multiple websites. Logs obtained by researchers reveal that AkiraBot successfully spammed over 80,000 domains while failing on approximately 11,000 attempts. In total, more than 420,000 unique domains were targeted.

User review/report for spam domain useakira[.]com

The use of AI-generated content in spam campaigns marks a significant shift in tactics. It highlights the dual-use nature of large language models: while they power innovations in automation and communication, they also provide tools for malicious activity.

OpenAI responded promptly after being alerted by SentinelLabs, disabling the API key associated with AkiraBot and reaffirming its commitment to preventing misuse. “Distributing output from our services for spam is against our policies,” OpenAI stated. “We take misuse seriously and are continually improving our systems to detect abuse.”

Despite this, SentinelLabs warns that AkiraBot’s operators are likely to continue refining their techniques as website hosting providers strengthen defenses. It noted that the campaign’s reliance on CAPTCHA bypassing technologies and proxy rotation demonstrates a high level of sophistication and determination.