01flip Multi-Platform Ransomware Written in Rust

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/
• Blog Title: 01flip: Multi-Platform Ransomware Written in Rust
• Suggested Section: Generic Methodologies & Resources -> Basic Forensic Methodology (Anti-Forensic Techniques) and Windows Hardening -> Antivirus (AV) Bypass / Windows Local Privilege Escalation (post-exploitation TTPs). A short cross-referenced note could also go under Linux Hardening -> Linux Post-Exploitation for Sliver TCP Pivot and self-wiping patterns, and under Binary Exploitation or Reversing -> Common API used in Malware for the Rust string-obfuscation and hybrid crypto design.

🎯 Content Summary

This blog provides a detailed technical analysis of 01flip, a new Rust-based multi-platform ransomware used in targeted attacks (cluster CL-CRI-1036) against a small set of victims in the Asia-Pacific region, including critical infrastructure organizations in Southeast Asia. Victim reports include a Zimbra email server compromise, and a dark web forum post suggests additional victims in Taiwan and the Philippines. Attackers are financially motivated, demand one bitcoin (BTC) per victim, and c...

🔧 Technical Details

1. Exploiting public RCEs on internet-facing services to bootstrap ransomware campaigns.
The campaign illustrates a generalizable pattern: attackers scan for internet-facing enterprise services with known RCEs (e.g., Atlassian Crowd CVE-2019-11580) and exploit them to gain initial access. Once a foothold is established on a perimeter or management server, they deploy C2 tooling (like Sliver) to pivot further inside. Defenders should treat exposed management/identity systems as high-value attack surfaces, aggressively patch RCEs, and monitor anomalous process spawns and outbound connections from such hosts.

2. Using Sliver beacons with TCP Pivot profiles for stealthy lateral movement.
Sliver (open source C2 framework) is used to maintain access and perform lateral movement. Operators deploy Linux ELF beacons configured as

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources -> Basic Forensic Methodology (Anti-Forensic Techniques) and Windows Hardening -> Antivirus (AV) Bypass / Windows Local Privilege Escalation (post-exploitation TTPs). A short cross-referenced note could also go under Linux Hardening -> Linux Post-Exploitation for Sliver TCP Pivot and self-wiping patterns, and under Binary Exploitation or Reversing -> Common API used in Malware for the Rust string-obfuscation and hybrid crypto design.".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0