First CPU‑Level Ransomware Proof‑of‑Concept Revealed – Why It Matters

The world’s first CPU‑level ransomware has been demonstrated, though it has not been released publicly.

Rapid7’s senior director of threat analysis, Chrstiaan Beek, wrote a proof‑of‑concept that can directly attack the CPU, take control of the BIOS, and demand ransom.

This attack can bypass most traditional ransomware detection methods.

Beek discovered a vulnerability in AMD’s Zen processors that allows an attacker to load unauthorized microcode, break hardware‑level encryption, and arbitrarily modify CPU behavior.

Google’s security team previously identified a similar flaw in AMD Zen 1‑4 CPUs, and later found that Zen 5 is also affected; the issue can be mitigated with new microcode updates.

Motivated by his firmware‑security background, Beek decided to develop a CPU ransomware PoC and confirmed he would not publish it.

He referenced leaked Conti ransomware group chats from 2022, which described a PoC that installs in UEFI so that encryption persists even after reinstalling Windows, remaining undetectable by antivirus software.

One hacker imagined controlling the BIOS and loading a custom bootloader that locks the drive until a ransom is paid.