New Multi-Platform 01flip Ransomware Supports Multi-platform Architecture, Including Windows and Linux
## Cybersecurity: 01flip Ransomware Update
Cybersecurity: 01flip Ransomware Update
In June 2025, security researchers at Palo Alto Networks identified a new ransomware threat, 01flip, marking a notable development in malware tactics.
The 01flip ransomware is written entirely in Rust and targets both Windows and Linux systems. This cross-platform feature reflects a trend in cybercrime towards using modern programming languages to enhance threat efficacy and stealth.
The ransomware primarily targets organizations in the Asia-Pacific region, especially those involved in critical infrastructure in Southeast Asia. The campaign, identified as CL-CRI-1036, is in its early stages but has the potential for rapid expansion due to its technical sophistication.
Although the exact attack vectors for 01flip remain partly unclear, the evidence indicates a strategic approach by financially motivated adversaries. Since early April 2025, attackers have exploited older vulnerabilities, such as CVE-2019-11580, in internet-facing applications like Zimbra Server email solutions.
In June 2025, security researchers at Palo Alto Networks identified a new ransomware threat, 01flip, marking a notable development in malware tactics.
By late May 2025, multiple instances of 01flip ransomware were distributed across Windows and Linux systems in compromised networks. The malware has demonstrated capabilities for lateral movement within networks, utilizing frameworks like Sliver to achieve this.
Palo Alto Networks analysts identified the ransomware through sandbox analysis and behavioral examination of suspicious Windows executables. The malware's name is derived from its file extension (.01flip) and contact email (01Flip@proton.me). Notably, the Linux variant evaded detection for three months post-submission to VirusTotal.
The ransomware uses a dual-layer encryption process. It encrypts files with AES-128-CBC and secures the session key using RSA-2048. The encryption renames files using the pattern: ORIGINAL_FILENAME.UNIQUE_ID.0 or 1.01flip.
01flip employs defense evasion techniques, including low-level API and system call usage, to blend with legitimate operations and avoid detection. The malware encodes user-defined strings, decoding them at runtime, and implements anti-sandbox detection based on the presence of specific strings.
These methods illustrate the developers' intent to balance complexity with operational efficiency, making 01flip a significant concern in the cybersecurity landscape.
Based on reporting by Cyber Security News.