• ESET Research has discovered new ransomware samples, which it has named HybridPetya, resembling the infamous Petya/NotPetya malware. They were uploaded to VirusTotal in February 2025.
• HybridPetya encrypts the Master File Table, which contains important metadata about all the files on NTFS-formatted partitions.
• Unlike the original Petya/NotPetya, HybridPetya can compromise modern UEFI-based systems by installing a malicious EFI application onto the EFI System Partition.
• One of the analyzed HybridPetya variants exploits CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems, leveraging a specially crafted cloak.dat file.
• ESET telemetry shows no signs of HybridPetya being used in the wild yet.

BRATISLAVA — September 12, 2025 — ESET Research has discovered a HybridPetya bootkit and ransomware uploaded from Poland to the malware-scanning platform VirusTotal. The sample is a copycat of the infamous Petya/NotPetya malware; however, it adds the capability of compromising UEFI-based systems and weaponizing CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems.

“Late in July 2025, we encountered suspicious ransomware samples under various filenames, including notpetyanew.exe and other similar ones, suggesting a connection with the infamously destructive malware that struck Ukraine and many other countries back in 2017. The NotPetya attack is believed to be the most destructive cyberattack in history, with more than $10 billion in total damages. Due to the shared characteristics of the newly discovered samples with both Petya and NotPetya, we named this new malware HybridPetya,” says ESET researcher Martin Smolár, who made the discovery.

The algorithm used to generate the victim’s personal installation key, unlike in the original NotPetya, allows the malware operator to reconstruct the decryption key from the victim’s personal installation keys. Thus, HybridPetya remains viable as regular ransomware – more like Petya. Additionally, HybridPetya is also capable of compromising modern UEFI-based systems by installing a malicious EFI application to the EFI System Partition. The deployed UEFI application is then responsible for encryption of the NTFS-related Master File Table (MFT) file – an important metadata file containing information about all the files on the NTFS-formatted partition.

“After a bit more digging, we discovered something even more interesting on VirusTotal: an archive containing the whole EFI System Partition contents, including a very similar HybridPetya UEFI application, but this time bundled in a specially formatted cloak.dat file, vulnerable to CVE-2024-7344 – the UEFI Secure Boot bypass vulnerability that our team disclosed in early 2025,” adds Smolár. ESET publications from January 2025 purposely refrained from detailing the exploitation; thus, the malware author probably reconstructed the correct cloak.dat file format based on reverse engineering the vulnerable application on their own.

ESET telemetry shows no active use of HybridPetya in the wild yet; thus, HybridPetya may just be a proof of concept developed by a security researcher or an unknown threat actor. Furthermore, this malware does not exhibit the aggressive network propagation seen in the original NotPetya.

For a more detailed analysis and technical breakdown of HybridPetya, check out the latest ESET Research blogpost: “Introducing HybridPetya: Petya/NotPetya copycat with UEFI Secure Boot bypass,” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Overview of HybridPetya’s execution logic

BRATISLAVA — September 4, 2025 — ESET, a global leader in cybersecurity, has been named a Strong Performer in The Forrester Wave™: Managed Detection And Response Services In Europe, Q3 2025. ESET believes this recognition underscores the strength of its ESET PROTECT Platform, which powers its Managed Detection and Response (MDR) services by combining regional threat intelligence with extended detection and response (XDR) capabilities.

According to the report,¹ “ESET leverages its Central and Eastern European presence to source highly localized threat intelligence to deliver MDR services. ESET has maintained trust by focusing on endpoint maturity and regional compliance, including dedicated EU tenancy and sovereign operations. Reference customers highlighted ESET’s transparency and hands-on support, noting local language capabilities and threat advisories as positive traits. Organizations with a significant endpoint landscape looking for strong regional threat intelligence should consider ESET.”

In line with Forrester’s focus on sovereignty, speed, and response maturity, ESET’s strategy highlights its strength in localized threat intelligence and commitment to EU regulatory compliance. Built on a robust foundation in endpoint security, ESET is further distinguished by its transparency, hands-on support, and deep regional presence.

“We are proud to be recognized a Strong Performer in Forrester’s evaluation of MDR services in Europe,” said Michal Jankech, Vice President, Enterprise & SMB/MSP, at ESET. “For us, this acknowledgment reflects our commitment to delivering high-quality, regionally attuned cybersecurity services that meet the evolving needs of European organizations. Our ESET PROTECT Platform continues to evolve, combining deep endpoint expertise with extended detection and response to help customers stay resilient in the face of complex threats. We remain dedicated to continuous innovation and progress, with a clear focus on further enhancing our MDR capabilities to meet future challenges.”

European CISOs increasingly rely on MDR providers not only for faster threat detection but also to maintain operational resilience amid regulatory, economic, and cybersecurity challenges. With mandates such as NIS2 and DORA, and a growing shortage of skilled professionals, MDR services must offer localized support, mature response capabilities, and compliance-driven data sovereignty.

ESET believes this recognition validates its strategic focus on regional threat visibility, trusted support, and compliance-first MDR delivery — all essential for organizations navigating today’s regulatory and threat landscape.

¹The Forrester Wave™: Managed Detection And Response Services In Europe, Q3 2025. Tope Olufon with Jinan Budge, Angela Lozada, Bill Nagel. September 3, 2025

Discover more about ESET MDR services and our XDR-enabling solution.

Find out how ESET helps businesses comply with cyber insurance and regulations.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity here.

• ESET Research discovers PromptLock, a new type of ransomware using GenAI to execute attacks.
• The malware runs a locally accessible AI language model to generate malicious Lua scripts in real time, which are compatible across Windows, Linux, and macOS.
• PromptLock uses a freely available language model accessed via an API, meaning the generated malicious scripts are served directly to the infected device.
• Based on predefined text prompts, PromptLock autonomously determines whether to exfiltrate or encrypt data.
• While ESET considers PromptLock a proof of concept, the threat it represents is very real.

BRATISLAVA — August 27, 2025 — ESET researchers have uncovered a new type of ransomware that leverages generative artificial intelligence (GenAI) to execute attacks. Named PromptLock, the malware runs a locally accessible AI language model to generate malicious scripts in real time. During infection, the AI autonomously decides which files to search, copy, or encrypt — marking a potential turning point in how cybercriminals operate.

“The emergence of tools like PromptLock highlights a significant shift in the cyber threat landscape,” said Anton Cherepanov, senior malware researcher at ESET, who analyzed the malware alongside fellow researcher Peter Strýček.

PromptLock creates Lua scripts that are compatible across platforms, including Windows, Linux, and macOS. It scans local files, analyzes their content, and — based on predefined text prompts — determines whether to exfiltrate or encrypt the data. A destructive function is already embedded in the code, though it remains inactive for now.

The ransomware uses the SPECK 128-bit encryption algorithm and is written in Golang. Early variants have already surfaced on the malware analysis platform VirusTotal. While ESET considers PromptLock a proof of concept, the threat it represents is very real.

“With the help of AI, launching sophisticated attacks has become dramatically easier — eliminating the need for teams of skilled developers,” added Cherepanov. “A well-configured AI model is now enough to create complex, self-adapting malware. If properly implemented, such threats could severely complicate detection and make the work of cybersecurity defenders considerably more challenging.”

PromptLock uses a freely available language model accessed via an API, meaning the generated malicious scripts are served directly to the infected device. Notably, the prompt includes a Bitcoin address reportedly linked to Bitcoin creator Satoshi Nakamoto.

ESET has published technical details to raise awareness within the cybersecurity community. The malware has been classified as Filecoder.PromptLock.A.

Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.