Howyar Uefi Application "Reloader"
A vulnerability exists in the Howyar UEFI Application "Reloader" that allows for the execution of unsigned software in a hardcoded path. This flaw, identified as CVE-2024-7344, bypasses UEFI Secure Boot protections, potentially enabling the installation of malicious bootkits. A new ransomware strain, HybridPetya, has been observed exploiting this vulnerability to gain persistence and encrypt systems. HybridPetya mimics the behavior of Petya/NotPetya ransomware, encrypting the NTFS Master File Table (MFT) and demanding a ransom payment. While HybridPetya has not yet been widely deployed in active attacks, its capabilities suggest a significant threat potential. The vulnerability resides in a UEFI application signed by Microsoft, impacting a range of systems. The exploitation of this vulnerability allows attackers to gain control at the boot level, potentially bypassing operating system-level security measures.