A recently discovered ransomware strain called HybridPetya can bypass the UEFI Secure Boot feature to install a malicious application on the EFI System Partition.

HybridPetya appears inspired by the destructive Petya/NotPetya malware that encrypted computers and prevented Windows from booting in attacks in 2016 and 2017 but did not provide a recovery option.

Researchers at cybersecurity company ESET found a sample of HybridPetya on VirusTotal. They note that this may be a research project, a proof-of-concept, or an early version of a cybercrime tool still under limited testing.

Still, ESET says that its presence is yet another example (along with BlackLotus, BootKitty, and Hyper-V Backdoor) that UEFI bootkits with Secure Bypass functionality are a real threat.

HybridPetya incorporates characteristics from both Petya and NotPetya, including the visual style and attack chain of these older malware strains.

However, the developer added new things like installation into the EFI System Partition and the ability to bypass Secure Boot by exploiting the CVE-2024-7344 vulnerability.

ESET discovered the flaw in January this year, The issue consists in Microsoft-signed applications that could be exploited to deploy bootkits even with Secure Boot protection active on the target.

Upon launch, HybridPetya determines if the host uses UEFI with GPT partitioning and drops a malicious bootkit into the EFI System partition consisting of several files.

These include configuration and validation files, a modified bootloader, a fallback UEFI bootloader, an exploit payload container, and a status file that tracks the encryption progress.

ESET lists the following files used across analyzed variants of HybridPetya:

1. \EFI\Microsoft\Boot\config (encryption flag + key + nonce + victim ID)
2. \EFI\Microsoft\Boot\verify (used to validate correct decryption key)
3. \EFI\Microsoft\Boot\counter (progress tracker for encrypted clusters)
4. \EFI\Microsoft\Boot\bootmgfw.efi.old (backup of original bootloader)
5. \EFI\Microsoft\Boot\cloak.dat (contains XORed bootkit in Secure Boot bypass variant)

Also, the malware replaces \EFI\Microsoft\Boot\bootmgfw.efi with the vulnerable ‘reloader.efi,’ and removes \EFI\Boot\bootx64.efi.

The original Windows bootloader is also saved to be activated in the case of successful restoration, meaning that the victim paid the ransom.

Once deployed, HybridPetya triggers a BSOD displaying a bogus error, as Petya did, and forces a system reboot, allowing the malicious bootkit to execute upon system boot.

At this step, the ransomware encrypts all MFT clusters using a Salsa20 key and nonce extracted from the config file while displaying a fake CHKDSK message, like NotPetya.

Once the encryption completes, another reboot is triggered and the victim is served a ransom note during system boot, demanding a Bitcoin payment of $1,000.

In exchange, the victim is provided a 32-character key they can enter on the ransom note screen, which restores the original bootloader, decrypts the clusters, and prompts the user to reboot.

Though HybridPetya has not been observed in any real attacks in the wild, similar projects may choose to weaponize the PoC and use it in broad campaigns targeting unpatched Windows systems at any time.

Indicators of compromise to help defend against this threat have been made available on this GitHub repository.

Microsoft fixed CVE-2024-7344 with the January 2025 Patch Tuesday, so Windows systems that have applied this or later security updates are protected from HybridPetya.

Another solid practice against ransomware is to keep offline backups of your most important data, allowing free and easy system restoration.

Microsoft warns that a threat actor tracked as Storm-0501 has evolved its operations, shifting away from encrypting devices with ransomware to focusing on cloud-based encryption, data theft, and extortion.

The hackers now abuse native cloud features to exfiltrate data, wipe backups, and destroy storage accounts, thereby applying pressure and extorting victims without deploying traditional ransomware encryption tools.

Storm-0501 is a threat actor who has been active since at least 2021, deploying the Sabbath ransomware in attacks against organizations worldwide. Over time, the threat actor joined various ransomware-as-a-service (RaaS) platforms, where they used encryptors from Hive, BlackCat (ALPHV), Hunters International, LockBit, and, more recently, Embargo ransomware.

In September 2024, Microsoft detailed how Storm-0501 extended its operations into hybrid cloud environments, pivoting from compromising Active Directory to Entra ID tenants. During these attacks, the threat actors either created persistent backdoors through malicious federated domains or encrypted on-premises devices using ransomware, such as Embargo.

A new report by Microsoft today outlines a shift in tactics, with Storm-0501 no longer relying on on-premises encryption and instead conducting attacks purely in the cloud.

“Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, cloud-based ransomware introduces a fundamental shift,” reads the report by Microsoft Threat Intelligence.

“Leveraging cloud-native capabilities, Storm-0501 rapidly exfiltrates large volumes of data, destroys data and backups within the victim environment, and demands ransom—all without relying on traditional malware deployment.”

Cloud-based ransomware attacks

In recent attacks observed by Microsoft, the hackers compromised multiple Active Directory domains and Entra tenants by exploiting gaps in Microsoft Defender deployments.

Storm-0501 then used stolen Directory Synchronization Accounts (DSAs) to enumerate users, roles, and Azure resources with tools such as AzureHound. The attackers eventually discovered a Global Administrator account that lacked multifactor authentication, allowing them to reset its password and gain complete administrative control.

With these privileges, they established persistence by adding malicious federated domains under their control, enabling them to impersonate almost any user and bypass MFA protections in the domain.

Microsoft says they escalated their access further into Azure by abusing the Microsoft.Authorization/elevateAccess/action, which allowed them to ultimately assign themselves to Owner roles, effectively taking over the victim’s entire Azure environment.

Once in control of the cloud environment, Storm-0501 began disabling defenses and stealing sensitive data from Azure Storage accounts. The threat actors also attempted to destroy storage snapshots, restore points, Recovery Services vaults, and storage accounts to prevent the target from recovering data for free.

When the threat actor couldn’t delete data from recovery services, they utilized cloud-based encryption by creating new Key Vaults and customer-managed keys, effectively encrypting the data with new keys and making it inaccessible to the company unless they pay a ransom.

After stealing data, destroying backups, or encrypting cloud data, Storm-0501 moved to the extortion phase, contacting victims through Microsoft Teams using compromised accounts to deliver ransom demands.

Microsoft’s report shares protection advice, Microsoft Defender XDR detections, and hunting queries that can help find and detect the tactics used by this threat actor.

As ransomware encryptors are increasingly blocked before they can encrypt devices, we may see other threat actors shift away from on-premise encryption to cloud-based data theft and encryption, which may be harder to detect and block.

Europol has confirmed that a Telegram channel impersonating the agency and offering a $50,000 reward for information on two Qilin ransomware administrators is fake. The impostor later admitted it was created to troll researchers and journalists.

“We were also surprised to see this story gaining traction,” Europol told BleepingComputer on Monday. “The announcement didn’t come from us.”

The statement comes after a new Telegram channel called @europolcti was created on August 16th, claiming to offer a $50,000 reward for information on two Qilin ransomware admins known as “Haise” and “XORacle”.

“During the course of ongoing international investigations, we have confirmed that the cybercriminal group Qilin has carried out ransomware attacks worldwide, severely disrupting critical infrastructure and causing significant financial losses,” reads the imposter’s Telegram post.

“We have identified two primary administrators operating under the aliases Haise and XORacle, who coordinate affiliates and oversee extortion activities.”

“We are actively pursuing all available leads in cooperation with international partners.”

“A reward of up to $50,000 is offered for information that directly leads to the identification or location of these administrators.”

Haise is believed to be one of the operators of the Qilian ransomware gang, previously recruiting affiliates on the RAMP cybercrime forum.

The Qilin ransomware operation was initially launched as “Agenda” in August 2022. However, by September that year, it had rebranded under the name Qilin, which it continues to use to this day.

The ransomware operation is one of the most active, currently targeting companies worldwide.

However, after Europol confirmed it was fake, a new post appeared on the imposter channel claiming it was created to troll researchers and journalists, some of whom wrote articles about the claims.

“This was so easy to run and fool so called ‘Researchers’ and ‘Journalists’ that just copy stuff.. Thank you all!,” reads the new post.

The post was signed by Rey, a hacker previously linked to breaches at Telefonica and Orange Group.

Threat actors had begun trolling Qilin in August 15th posts on a Telegram channel impersonating threat actors from “Scattered Spider”, “ShinyHunters”, and “Lapsus,” where someone had begun calling out Haise and the ransomware operation.

This is not the first time threat actors attempted to mislead the media about cybercrime.

In 2021, a RAMP admin known as ‘Orange’ or ‘boriselcin’ and who ran the “Groove” ransomware site, called on threat actors to attack the USA. This threat actor was later sanctioned by the US for his involvement in three ransomware operations that targeted victims across the United States.

After the media covered this post, including BleepingComputer, the threat actor claimed it was fake and was created to troll and manipulate the media and security researchers.

However, security researchers from McAfee and Intel 471 believe that it was likely the threat actor trying to cover up for a failed ransomware-as-a-service.

In 2023, BleepingComputer receieved a “tip” about an alleged arrest of two Canadian teens over a crypto-theft attack.

While BleepingComputer learned that the news was fake and did not cover the story, we were told it was done to manipulate the media and “troll” the people accused of the theft.

UK-based telecommunications company Colt Technology Services is dealing with a cyberattack that has caused a multi-day outage of some of the company’s operations, including hosting and porting services, Colt Online, and Voice API platforms.

The British telecommunications and network services provider disclosed that the attack started on August 12 and the disruption continues as its IT staff works around the clock to mitigate its effects.

Founded in 1992 as City of London Telecommunications (COLT) and acquired by Fidelity Investments in 2015, Colt is a major telecommunications service provider operating in 30 countries across Europe, Asia, and North America. The company employs 75,000 km of fiber networks linking 900 data centers.

Services still offline

Initially, the company announced a “technical issue” without confirming a cyber incident. However, the nature of the event was communicated in subsequent status updates.

The attack forced the firm to take specific systems offline as a protective measure, which affected the operations of support services, including Colt Online and the Voice API platform.

Customer communication through online portals is currently unavailable, and clients are advised to contact Colt by email or phone and expect slower-than-usual responses.

The company underlined that the impacted systems are support services, not the core customer network infrastructure.

As of today, there is no estimation for restoring affected systems and operations.

Colt says it has notified the authorities about the incident without providing any details about the perpetrators or the type of attack.

WarLock claims the attack

A threat actor using the alias ‘cnkjasdfgd’ and claiming to be a member of the WarLock ransomware gang claimed the attack and offered to sell for $200,000 a batch of one million documents allegedly stolen from Colt.

Several data samples have also been published to prove the validity of the files. According to the threat actor, the stolen files include financial, employee, customer, and executive data, internal emails, and software development information.

Although the telecommunications company did not disclose the cause of the breach, security researcher Kevin Beaumont says that the hacker likely managed to gain initial access by exploiting a remote code execution vulnerability in Microsoft SharePoint tracked as CVE-2025-53770.

The security issue has been exploited as a zero-day since at least July 18 and is considered critical in severity. Microsoft addressed it in a security update on July 21.

According to Beaumont, the hackers stole a few hundred gigabytes of files with customer data and documentation.

BleepingComputer has contacted Colt to ask for verification of these allegations, and a spokesperson sent us the below comment:

“We’re aware of claims regarding the cyber incident. We are currently investigating these claims.”

“Our technical team is focused on restoring the internal systems impacted by the cyber incident and is working closely with third-party cyber experts. We are grateful for our customers’ understanding as we work towards a resolution to fix the impacted internal systems.” – Colt spokesperson

Update 8/15 – Added comment from Colt

The U.S. Justice Department authorized the seizure of more than $2.8 million in cryptocurrency, cash, and other assets from a suspected ransomware operator, according to an Aug. 14 announcement.

Federal prosecutors unsealed six warrants tied to Ianis Aleksandrovich Antropenko, charging him with conspiring to commit computer fraud and abuse, committing computer fraud and abuse, and conspiracy to commit money laundering.

In addition to the crypto, authorities also seized $70,000 in cash and a luxury vehicle. The digital assets seized in the raid are expected to be added to the government’s growing crypto reserve.

According to the Justice Department, the assets were linked to ransomware proceeds and laundered through methods including the now-defunct mixing service ChipMixer, which was dismantled in an international operation in 2023.

Officials said Antropenko also converted crypto to cash and made structured deposits to avoid detection.

Part of expanding federal stockpile

The case marks the latest government action involving crypto that could be directed into the U.S. national crypto reserve, created by an executive order enacted by President Donald Trump in March.

Earlier this week, the Justice Department announced the seizure of roughly $1 million from the ransomware group BlackSuit and moved to claim $2.4 million in Bitcoin (BTC) seized by the FBI in Dallas in April.

Treasury Secretary Scott Bessent recently revealed that the government’s Bitcoin holdings, acquired through criminal asset forfeitures after victim restitution, totaled about $20 billion.

Bessent drew attention earlier in the week after saying the government would not be buying additional Bitcoin for the reserve. He later backtracked and clarified that the Treasury will continue to seek “budget-neutral” ways to expand its holdings.

Mentioned in this article

The US has seized servers, domain names, and around $1 million in crypto assets from the ransomware group BlackSuit.

The Justice Department said on Monday that multiple US and international law enforcement agencies conducted an operation against the BlackSuit ransomware groups in late July.

The operation included the unsealing of a warrant for the seizure of cryptocurrency valued at just over $1 million, at the time of the seizure, it reported. 

“Disrupting ransomware infrastructure is not only about taking down servers, it’s about dismantling the entire ecosystem that enables cybercriminals to operate with impunity,” added Michael Prado, Deputy Assistant Director at the Homeland Security Investigations Cyber Crimes Center.

Blacksuit is a spinoff of the Royal ransomware gang and has operated since at least 2023, with the latest seizure coming amid other actions the US has taken against ransomware groups, such as sanctioning the ransomware hosting provider Aeza Group in July.

The Justice Department said the takedown was led by the US Department of Homeland Security’s Homeland Security Investigations with help from the Secret Service, the IRS and the FBI, along with law enforcement from the UK, Germany, Ireland, France, Canada, Ukraine, and Lithuania.

Coordinated ransomware attacks 

The Justice Department said the ransomware group persistently targeted critical infrastructure across sectors, including healthcare, government facilities, manufacturing, and commercial facilities. Victims are typically forced to pay ransoms in Bitcoin (BTC) through darknet websites.

Since 2022, BlackSuit has compromised over 450 known victims in the US and has received more than $370 million in ransom payments, it added.

The ransomware schemes used double-extortion tactics such as encrypting victims’ systems while threatening to leak stolen data to further coerce payment, the DOJ stated. 

“The BlackSuit ransomware gang’s persistent targeting of US critical infrastructure represents a serious threat to US public safety,” said Assistant Attorney General for National Security John Eisenberg.

Bitcoin ransom seized 

In 2023, a victim paid a ransom of 49.3 BTC, worth around $1.4 million at the time, to decrypt their data. 

A portion of the ransom payment, the seized $1 million, was repeatedly deposited and withdrawn from a crypto exchange account until the funds were frozen by the exchange in early 2024, it reported, though it did not name the exchange. 

Related: US sanctions crypto wallet tied to ransomware, infostealer host

Ransom demands have typically ranged from approximately $1 million to $10 million in BTC, and the largest ransom demanded by BlackSuit actors was $60 million, according to the Cybersecurity and Infrastructure Security Agency.

Crypto ransomware successors crop up

In July, the Dallas, Texas, FBI announced the seizure of 20 BTC valued at around $2.4 million from a cryptocurrency address belonging to a prominent member of the Chaos ransomware group.

Last week, analysts at TRM Labs investigated how a new ransomware group called Embargo may have emerged as a successor operation to BlackCat, which launders proceeds through crypto accounts. Approximately $18.8 million worth remains dormant in unattributed wallets, it revealed. 

Magazine: Scottie Pippen says Michael Saylor warned him about Satoshi chatter

]]> https://earlybirdsinvest.com/us-takes-down-sites-seizes-1m-from-crypto-ransomware-gang-blacksuit/feed/ 0 52931 https://earlybirdsinvest.com/akira-ransomware-abuses-cpu-tuning-tool-to-disable-microsoft-defender/ https://earlybirdsinvest.com/akira-ransomware-abuses-cpu-tuning-tool-to-disable-microsoft-defender/#respond Thu, 07 Aug 2025 00:53:11 +0000 https://earlybirdsinvest.com/akira-ransomware-abuses-cpu-tuning-tool-to-disable-microsoft-defender/

Akira ransomware is abusing a legitimate Intel CPU tuning driver to turn off Microsoft Defender in attacks from security tools and EDRs running on target machines.

The abused driver is ‘rwdrv.sys’ (used by ThrottleStop), which the threat actors register as a service to gain kernel-level access.

This driver is likely used to load a second driver, ‘hlpdrv.sys,’ a malicious tool that manipulates Windows Defender to turn off its protections.

This is a ‘Bring Your Own Vulnerable Driver’ (BYOVD) attack, where threat actors use legitimate signed drivers that have known vulnerabilities or weaknesses that can be abused to achieve privilege escalation. This driver is then used to load a malicious tool that disables Microsoft Defender.

“The second driver, hlpdrv.sys, is similarly registered as a service. When executed, it modifies the DisableAntiSpyware settings of Windows Defender within \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware,” explain the researchers.

“The malware accomplishes this via execution of regedit.exe.”

This tactic was observed by Guidepoint Security, which reports seeing repeated abuse of the rwdrv.sys driver in Akira ransomware attacks since July 15, 2025.

“We are flagging this behavior because of its ubiquity in recent Akira ransomware IR cases. This high-fidelity indicator can be used for proactive detection and retroactive threat hunting,” continued the report.

To help defenders detect and block these attacks, Guidepoint Security has provided a YARA rule for hlpdrv.sys, as well as complete indicators of compromise (IoCs) for both drivers, their service names, and file paths where they are dropped.

Akira attacks on SonicWall SSLVPN

Akira ransomware was recently linked to attacks on SonicWall VPNs using what is believed to be an unknown flaw.

Guidepoint Security says it could neither confirm nor debunk the exploitation of a zero-day vulnerability in SonicWall VPNs by Akira ransomware operators.

In response to reports about elevated offensive activity, SonicWall advised disabling or restricting SSLVPN, enforcing multi-factor authentication (MFA), enabling Botnet/Geo-IP protection, and removing unused accounts.

Meanwhile, The DFIR Report has published an analysis of recent Akira ransomware attacks, highlighting the use of the Bumblebee malware loader delivered via trojanized MSI installers of IT software tools.

An example involves searches for “ManageEngine OpManager” on Bing, where SEO poisoning redirected the victim to the malicious site opmanager[.]pro.

Bumblebee is launched via DLL sideloading, and once C2 communication is established, it drops AdaptixC2 for persistent access.

The attackers then conduct internal reconnaissance, create privileged accounts, and exfiltrate data using FileZilla, while maintaining access via RustDesk and SSH tunnels.

After approximately 44 hours, the main Akira ransomware payload (locker.exe) is deployed to encrypt systems across domains.

Until the SonicWall VPN situation clears up, system administrators should monitor for Akira-related activity and apply filters and blocks as indicators emerge from security research.

It is also strongly advised to only download software from official sites and mirrors, as impersonation sites have become a common source for malware.

Russian professional basketball player Daniil Kasatkin was arrested in France at the request of the United States for allegedly acting as a negotiator for a ransomware gang.

Daniil Kasatkin is a Russian basketball player who briefly played NCAA basketball at Penn State before returning to Russia in 2019. In four seasons with MBA-MAI, he appeared in 172 games before he left the team.

According to French media, Kasatkin was arrested at Paris’s Charles de Gaulle airport on June 21st after landing in France with his fiancée.

The arrest was made as part of a United States international arrest warrant for his role as an alleged negotiator for a ransomware gang.

Kasatkin is now under custody while the US seeks to have him extradited to face charges of “conspiracy to commit computer fraud” and “computer fraud conspiracy.”

His lawyer alleges that Kasatkin is not guilty of these crimes and that they are instead linked to a second-hand computer that he purchased.

“He bought a second-hand computer. He did absolutely nothing. He’s stunned ,” his lawyer, Frédéric Bélot, told the media.

“He’s useless with computers and can’t even install an application. He didn’t touch anything on the computer: it was either hacked, or the hacker sold it to him to act under the cover of another person.”

While the name of the ransomware gang was not disclosed, it is reported to have been behind attacks on more than 900 companies, including two federal agencies, between 2020 and 2022.

This description closely matches similar language used by the Department of Justice to refer to the notorious Conti ransomware gang, which emerged as a successor to Ryuk in 2020 and shut down in 2022, following a data breach.

However, it was not previously reported that Conti breached any federal agencies, though they are linked to attacks on state governments.

Last month, French police also arrested four alleged operators of the BreachForums hacking forum, including threat actors using the alias IntelBroker and ShinyHunters.

Update 7/6/25: Added Ingram Micro’s confirmation it suffered a ransomware attack below. Also updated ransom note with clearer version.

An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned.

Ingram Micro is one of the world’s largest business-to-business technology distributors and service providers, offering a range of solutions including hardware, software, cloud services, logistics, and training to resellers and managed service providers worldwide.

Since Thursday, Ingram Micro’s website and online ordering systems have been down, with the company not disclosing the cause of the issues.

BleepingComputer has now learned that the outages are caused by a cyberattack that occurred early Thursday morning, with employees suddenly finding ransom notes created on their devices.

The ransom note, seen by BleepingComputer, is associated with the SafePay ransomware operation, which has become one of the more active operations in 2025. It is unclear if devices were actually encrypted in the attack.

It should be noted that while the ransom note claims to have stolen a wide variety of information, this is generic language used in all SafePay ransom notes and may not be true for the Ingram Micro attack.

Do you have information about this or another cyberattack? If you want to share the information, you can contact us securely and confidentially on Signal at LawrenceA.11, via email at lawrence.abrams@bleepingcomputer.com, or by using our tips form.

Sources have told BleepingComputer that it is believed the threat actors breached Ingram Micro through its GlobalProtect VPN platform.

Once the attack was discovered, employees in some locations were told to work from home. The company also shut down internal systems, telling employees not to use the company’s GlobalProtect VPN access, which was said to be impacted by the IT outage.

Systems that are impacted in many locations include the company’s AI-powered Xvantage distribution platform and the Impulse license provisioning platform. However, BleepingComputer was told that other internal services, such as Microsoft 365, Teams, and SharePoint, continue to operate as usual.

As of yesterday, Ingram Micro has not disclosed the attack publicly or to its employees, only stating there are ongoing IT issues, as indicated by company-wide advisories shared with BleepingComputer.

The SafePay ransomware gang is a relatively new operation that was first seen in November 2024, accumulating over 220 victims since then.

The ransomware operation has been previously observed breaching corporate networks through VPN gateways using compromised credentials and password spray attacks.

BleepingComputer contacted Ingram Micro yesterday and today about the outages and ransomware attack, but did not receive a response to our emails.

Update 7/6/25: In a brief Sunday morning announcement, Ingram Micro has confirmed that they suffered a ransomware attack.

“Ingram Micro recently identified ransomware on certain of its internal systems,” reads Ingram Micro’s statement.

“Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.”

“Ingram Micro is working diligently to restore the affected systems so that it can process and ship orders, and the Company apologizes for any disruption this issue is causing its customers, vendor partners, and others.”