NEW RANSOMWARE 01FLIP: MULTI-PLATFORM RANSOMWARE WRITTEN IN RUST

Summary from the TLDR InfoSec newsletter

01flip is a new Rust-based ransomware family (tracked as CL-CRI-1036) that targets critical infrastructure in the Asia-Pacific region, leveraging Rust's cross-compilation capabilities to support both Windows and Linux platforms. Attackers exploited CVE-2019-11580 for initial access, deployed Sliver C2 framework for lateral movement, and used AES-128-CBC with RSA-2048 encryption while demanding one bitcoin ransom, with subsequent data leaks appearing on dark web forums. Organizations should monitor for Rust-based malware signatures, patch internet-facing applications against known vulnerabilities, and implement detection for cross-platform ransomware that uses low-level API calls and string obfuscation techniques to evade traditional security controls.