Endpoint Security
,
Hardware / Chip-level Security
Malware Not Yet Deployed in the Wild, Says Eset
Researchers at Eset said Friday they spotted a copycat version of the infamous Petya/NotPetya malware that they dub “HybridPetya.”
See Also: OnDemand | Protecting Devices and Software from Next-Generation Cyberthreats
No telemetry exists to suggest HybridPetya has been deployed in the wild yet and it certainly lacks the aggressive propagation properties of NotPetya, which in 2017 spiraled into a global infection causing $10 billion in damage.
It also differs in one key respect: It can compromise the secure boot feature of Unified Extensible Firmware Interface by installing a malicious application. It joins a list of real or proof of concept UEFI bootkits including BlackLotus, Bootkitty and the Hyper-V Backdoor proof of concept.
Attacker prize bootkits since malware at that level can evade detection by antivirus applications and survive operating system reinstalls. With access to the UEFI, hackers can deploy their own kernel-mode payloads.
HybridPetya mirrors its antecedents by encrypting the master file table storing file, directory and metafile data for NTFS-formatted files kept on Windows machines. It uses a similar attack chain and has some of the same visual elements. But one other key difference from its predecessors is that HybridPetya creates the possibility of decrypting the files it maliciously crypto-locks.
Once HybridPetya takes control of a system and encrypts the master file table, it presents the victim with a ransom note demanding payment of $1,000 in bitcoin.
Eset said it found HybridPetya samples uploaded in February to Google’s VirusTotal platform. That led researcher to an archive containing a bootkit variant researchers say is almost certainly part of the HybridPetya toolkit. That installer takes advantage of CVE-2024-7344, a flaw in a Microsoft-signed UEFI application called reloader.efi for which the computing giant revoked approvals in January (see: Researchers Spot Serious UEFI Secure Boot Bypass Flaw).
The exploitation mechanism, Eset wrote, is simple. A file, cloak.dat contains an UEFI application. When the reloader.efi binary is executed during boot, “it searches for the presence of the cloak.dat file on the EFI System Partition, and loads the embedded UEFI application from the file in a very unsafe way, completely ignoring any integrity checks, thus bypassing UEFI Secure Boot.”
Eset said the hackers behind HybridPetya likely reversed engineered for themselves the correct cloak.dat format. Windows machines carrying the patch against CVE-2024-7344 are not vulnerable to the malware.