New 01flip Ransomware Hits APAC Critical Infra: Cross-Platform Rust Weapon Uses Sliver C2

New 01flip ransomware has entered the cybercrime arena, targeting critical infrastructure in the Asia-Pacific region with a cross-platform Rust weapon that can strike Windows and Linux systems. According to Unit 42 researchers at Palo Alto Networks, the activity is being tracked under the cluster identifier CL-CRI-1036 and appears to be in its early stages, with victims already reported in the Philippines and Taiwan.

The malware is fully written in Rust and leverages Rust’s cross-compilation features to support multi-platform architectures. The campaign is believed to have compromised networks manually rather than through automated spray, with an initial foothold linked to a vulnerability such as CVE-2019-11580 and the deployment of Sliver to maintain access and move laterally.

The 01flip encryptor includes a hardcoded list of file extensions to ignore, including a “lockbit” extension, prompting cautious discussion about a possible overlap with the LockBit ransomware group, though researchers see no definitive connection. Unit 42 notes that the attackers have already carried out data leaks on the dark web and that defenders face challenges from modern languages like Rust in malware development.