01flip: Multi-Platform Ransomware Written in Rust

In June 2025, Unit 42 researchers observed a new ransomware family named 01flip targeting a limited set of victims in the Asia-Pacific region. 01flip is written entirely in Rust and supports multi-platform architectures, including Windows and Linux, through Rust’s cross-compilation.

The campaign appears financially motivated, with attackers behind CL-CRI-1036 reported to have demanded one bitcoin for decrypting files, and a data leak alleging to involve the affected organisation was posted on a dark web forum shortly after the deployment. The ransomware encrypts files using AES-128-CBC and RSA-2048, creates ransom notes, and renames encrypted files with the pattern <ORIGINAL_FILENAME>.<UNIQUE_ID>.<0 or 1>.01flip, while also attempting to remove traces after encryption.

Initial access discussions indicate exploitation attempts targeting CVE-2019-11580 and later lateral movement using Sliver components to deploy additional 01flip instances across Windows and Linux machines. The researchers note a potential overlap with other groups, such as those behind LockBit, due to a shared extension in the encryption exclusion list, though no direct connection is claimed. According to Unit 42, the activity is in its early stages and may be connected to a reported dark web data leak.