A new threat is emerging in cybersecurity that renders traditional antivirus software nearly useless. Unlike typical malware, this method doesn’t target files or operating systems—it goes straight for the hardware. Experts warn that ransomware could soon be injected directly into the CPU through vulnerabilities in modern processors, bypassing all existing software protections.
Attackers could exploit CPU microcode
The foundation of this threat lies in newly discovered vulnerabilities in AMD’s Ryzen processors, which allow attackers to load malicious microcode directly into the CPU. This low-level access means malicious instructions could be executed without leaving traces on the hard drive, making detection nearly impossible for standard antivirus solutions.
Security researcher Christiaan Beek has raised alarms after realizing the potential for such attacks. During an experiment, Google showed how CPU microcode could be manipulated to always return a specific number when randomness was expected. This kind of manipulation, while seemingly simple, demonstrates the ease with which processor logic can be altered if vulnerabilities are exploited.
Ransomware might soon live in hardware
If threat actors manage to insert ransomware at the CPU level, they could encrypt or disrupt systems without ever touching the operating system or files. And unlike traditional attacks, there would be no software-level evidence or process for antivirus software to flag.
Even more worrying, this type of attack could survive system formats and OS reinstalls, much like firmware-level malware such as BlackLotus, which has already appeared on the black market. As software-based defenses become less effective, hardware-focused attacks signal a new era of persistent, undetectable threats.