01flip: Multi-Platform Ransomware Written in Rust
Summary: Unit 42 observed a new ransomware family called 01flip in June 2025, fully written in Rust and cross-compiled for Windows and Linux, targeting a limited set of victims in the Asia-Pacific region. Attackers tracked as CL-CRI-1036 gained access through attempted exploits of older vulnerabilities such as CVE-2019-11580 from early April 2025, deployed Sliver implants for lateral movement, and a week after moving to a second Linux machine pushed multiple 01flip instances across Windows and Linux devices, demanding one bitcoin per victim.
Why it matters: The Linux 01flip sample showed zero detections on VirusTotal at least three months after submission, and victims include organizations responsible for critical infrastructure in Southeast Asia - so the tooling is already in the wild ahead of the defenses meant to catch it.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Data Breaches
- Mentions
- CVE-2019-11580
- Related
- CVE-2019-11580: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026