Hybridpetya UEFI Bootloader Hijack

Tim Peck@timpeck

•updated Sep 12, 2025•1•0•31

Detects attempts to replace the legitimate UEFI bootloader (bootmgfw.efi) with a malicious one by creating a backup (.old file) and modifying the original. This is a critical persistence technique used by the HybridPetya ransomware.