What is 01flip Ransomware?
01flip is a newly discovered strain of ransomware that uses the Rust programming language to encrypt files on compromised systems. Unlike traditional ransomware, which often targets only Windows systems, 01flip can affect both Windows and Linux systems. This cross‑platform capability makes it a unique and particularly dangerous threat, as it can infect a wide range of devices.
The ransomware is primarily being used in targeted attacks by financially motivated cybercriminals. Its main objective is to encrypt critical data on compromised systems, rendering them useless unless a ransom is paid to decrypt the files. Once deployed, it hides itself and avoids detection by blending in with normal system processes. This allows it to stay in the system for long periods, making it harder to identify and remove.
Why Is 01flip Dangerous?
01flip has several characteristics that make it dangerous and difficult to stop:
- Cross-Platform Infection:
It can infect both Windows and Linux systems, unlike many ransomware strains that target only one platform. This increases its reach, especially in environments with mixed operating systems. - Written in Rust:
01flip is written in Rust, a programming language known for producing small, efficient, and fast binaries. This makes the malware harder to detect using traditional security tools. - Advanced Evasion Techniques:
It uses encrypted communications and hides its activities by masquerading as legitimate system processes, which makes it hard for antivirus software and other detection tools to recognize it. - Persistent Backdoor:
Once it gains access to a system, 01flip installs itself in a way that allows it to remain hidden and continue operating without being detected. This persistence means that attackers can maintain long-term access to the compromised system. - Data Exfiltration:
In addition to encrypting files, the malware can also steal sensitive data from the infected system and send it to external servers controlled by the attackers.
How Does 01flip Ransomware Work?
Here’s how the 01flip ransomware typically operates once it has successfully infiltrated a system:
- Initial Infection
The attackers typically gain access to a victim’s system using methods such as:
- Exploiting vulnerabilities in outdated software.
- Phishing emails that trick users into downloading malicious attachments or clicking on harmful links.
- Compromised credentials, which might allow attackers to log in remotely to servers or workstations.
Once inside, the attackers start scanning the network to identify more vulnerable systems and gain higher privileges by stealing passwords or credentials from local machines.
- Deployment of 01flip
Once the attackers have established a foothold, they deploy 01flip ransomware on key machines within the network. It typically targets Windows servers or Linux machines that store sensitive information or business-critical files. When executed, the malware:
- Encrypts files on the affected systems.
- Renames the files to include a unique extension, typically .01flip, to indicate they’ve been encrypted.
- Leaves a ransom note in each directory, informing the victim how to pay for the decryption key.
- Ransom Demand
After encrypting the files, 01flip demands a ransom from the victim in exchange for the decryption key. The ransom note usually provides instructions on how to contact the attackers and pay for the decryption tool.
Technical Details: What Makes 01flip Stand Out?
- Rust Programming Language: The choice of Rust makes 01flip a more efficient and compact malware strain. It is harder to analyze and less detectable by antivirus programs because of its unique binary format.
- Cross-Platform: It can affect both Windows and Linux systems, making it dangerous to a wider range of organizations, especially those with mixed environments.
- Advanced Encryption: 01flip uses a combination of AES-128 and RSA-2048 encryption algorithms to lock down files, making them nearly impossible to recover without the decryption key.
- Evasion Techniques: The malware avoids detection by using encrypted communication channels (like HTTPS or DNS-over-HTTPS), which look like normal internet traffic. This allows it to blend in with legitimate data traffic and avoid being flagged by network monitoring systems.
- Persistence Mechanism: 01flip hides in the system by masquerading as legitimate system processes and uses self-repair techniques to maintain its presence even after attempts to remove it.
Indicators of Compromise (IOCs) for 01flip
To detect 01flip ransomware, look out for these key indicators that can help identify the malware in your environment.
File Hashes (SHA256)
These are the fingerprints of known 01flip ransomware files. If these files are found on your system, they are likely linked to 01flip:
6aad1c36ab9c7c44350ebe3a17178b4fd93c2aa296e2af212ab28d711c0889a3
e5834b7bdd70ec904470d541713e38fe933e96a4e49f80dbfb25148d9674f957
ba41f0c7ea36cefe7bc9827b3cf27308362a4d07a8c97109704df5d209bce191
Ransom Note File
After encrypting files, 01flip creates a ransom note typically named:
RECOVER-YOUR-FILE.TXT
This file contains instructions on how to pay the ransom and receive the decryption key.
File Extension Change
After encryption, the malware appends the .01flip extension to encrypted files. For example:
document.docx -> document.123456.01flip
Suspicious Network Indicators
01flip communicates with remote servers to send stolen data and receive commands. If you notice encrypted DNS or WebSocket traffic to unknown or suspicious IP addresses, it could indicate the presence of 01flip. Example IPs associated with 01flip include:
208.83.233[.]14
149.28.120[.]31
Sigma Detection Rules for 01flip
Sigma rules are a standardized way to detect threats within SIEM (Security Information and Event Management) systems. Below are detection rules to identify the presence of 01flip ransomware based on file activity, network traffic, and system behavior.
Sigma Rule 1: Detecting Suspicious DNS-over-HTTPS (DoH) Traffic
This rule detects DNS-over-HTTPS traffic, which 01flip uses for its C2 (command-and-control) communications:
title: Detect Suspicious DNS-over-HTTPS Traffic (01flip)
id: efd91c6c-41fb-423d-bff9-4c8b825b2de9
status: experimental
description: |
Detects DNS-over-HTTPS traffic to suspicious or known bad IPs associated with 01flip.
author: Threat Intelligence Team
date: 2025-12-12
logsource:
category: network
product: network_traffic
detection:
selection:
protocol: dns
dns_query:
– “*01flip*”
dns_flags:
– “doH”
condition: selection
fields:
– dns_query
– source_ip
– destination_ip
– destination_port
– timestamp
falsepositives:
– Legitimate internal DNS traffic for cloud services
level: high
Sigma Rule 2: Detecting Suspicious WebSocket Communications
This rule detects suspicious WebSocket traffic that could indicate 01flip is using it for C2 activity:
title: Detect Suspicious WebSocket Communication (01flip)
id: 537f4a29-ded4-4b1f-bb5b-569ff029faaf
status: experimental
description: |
Detects WebSocket traffic that is unusual for the environment, which could indicate 01flip C2 activity.
author: Threat Intelligence Team
date: 2025-12-12
logsource:
category: network
product: web
detection:
selection:
protocol: tcp
destination_port: 443
user_agent:
– “*WebSocket*”
tls_cipher_suite:
– “TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256”
condition: selection
fields:
– source_ip
– destination_ip
– destination_port
– user_agent
– timestamp
falsepositives:
– Legitimate internal WebSocket traffic (for real-time applications)
level: high
Sigma Rule 3: Detecting Unauthorized VM Creation (01flip)
This rule helps detect when 01flip attempts to create rogue virtual machines for persistence:
title: Detect Unauthorized VM Creation (01flip)
id: 55a0e80a-cfae-4856-88f1-f01a7137ad04
status: experimental
description: |
Detects unauthorized virtual machine creation, often used by 01flip to create hidden VMs for long-term persistence.
author: Threat Intelligence Team
date: 2025-12-12
logsource:
category: virtualization
product: vmware
detection:
selection:
event_id: 1001
vm_name:
– “*hidden*”
– “*rogue*”
vm_state: “created”
condition: selection
fields:
– vm_name
– vm_state
– host_ip
– timestamp
falsepositives:
– Legitimate internal virtual machine provisioning
level: high
What Should You Do if You Detect 01flip?
- Disconnect Compromised Systems: Immediately isolate infected devices from the network to prevent further damage.
- Review Logs: Look for unusual activity such as encrypted file extensions, ransom notes, or odd network traffic.
- Change Credentials: Reset passwords and other credentials for sensitive systems, especially for admin accounts.
- Apply Security Patches: Make sure all systems are updated and patched, especially any internet-facing applications.
- Run a Full Network Scan: Conduct a thorough scan of your network to check for additional signs of compromise.
Conclusion
01flip is an advanced cross-platform ransomware that can affect both Windows and Linux systems. It’s written in Rust to evade detection, and it uses encrypted communication to hide its activity. With multi-layered encryption, it encrypts sensitive data and demands a ransom. By using Sigma detection rules and monitoring for IOCs, defenders can quickly identify the presence of 01flip and take appropriate action.
