Loading story…
A new ransomware family named 01flip has emerged, targeting critical infrastructure organizations in the Asia-Pacific region, specifically in countries such as the Philippines and Taiwan. This ransomware is notable for being fully written in the Rust programming language, enabling it to infect both Windows and Linux systems through cross-compilation. Researchers from Unit 42 at Palo Alto Networks have tracked this activity under the cluster identifier CL-CRI-1036, observing that the attackers employ a hands-on approach, manually exploiting vulnerabilities like CVE-2019-11580 to gain initial access. Once inside, the threat actors deploy the open-source Sliver C2 framework to maintain persistence and facilitate lateral movement within compromised networks.
The campaign, first detected in June 2025, has already resulted in confirmed data leaks, with stolen information being offered for sale on dark web forums. The attackers are financially motivated and have demonstrated a preference for targeted, rather than opportunistic, attacks. Security researchers emphasize the sophistication of 01flip, highlighting its multi-platform capabilities and the use of advanced adversary emulation tools. Organizations in the APAC region are advised to remain vigilant, as the campaign appears to be in its early stages but poses a significant threat to critical infrastructure sectors.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In June 2025, Unit 42 publicly reported the newly observed Rust-based, multi-platform ransomware family 01flip and tracked the activity cluster as CL-CRI-1036 targeting a limited number of APAC victims.
Following ransomware deployment, the attackers demanded 1 BTC for decryption and an alleged victim data leak was posted on a dark web forum, although researchers could not fully verify the leak's legitimacy.
By late May 2025, the CL-CRI-1036 operators distributed multiple 01flip ransomware instances across both Windows and Linux devices in a small number of APAC victim environments, including targets in the Philippines and Taiwan.
After gaining access, the operators deployed a Linux Sliver implant and later used a Sliver TCP pivot to support persistence and lateral movement in targeted Asia-Pacific environments.
Investigators observed exploitation attempts against older vulnerabilities, including CVE-2019-11580, beginning in early April 2025 as the initial access stage of the 01flip intrusion activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Clop** ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to **TA505**, describing attacks in which operators used tools such as **Cobalt Strike** and **Mimikatz**, encrypted files with `.Clop` or `.CIop` extensions, and disrupted business operations at victims including **E-Land Group**, **Software AG**, and reportedly **Indiabulls Group**. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to **double extortion** and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as **`CVE-2023-0669`** in **Fortra GoAnywhere MFT**, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the **U.S., Canada, Peru, China, Taiwan, and Europe** across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 15, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026
INC ransomware has grown into one of the most active **ransomware-as-a-service** operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than **800 claimed victims**, uses **double extortion** by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations. Researchers said INC has upgraded both its **Windows** and **Linux/ESXi** encryptors by rewriting them in **Rust**, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including **Citrix Bleed 2**, **Citrix NetScaler**, **SimpleHelp RMM**, and **Fortinet EMS** vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from **Veeam** environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as **rclone**; analysts also linked INC code to related strains including **Lynx**, **Sinobi**, and **Knoba** after the group’s source code was reportedly sold to multiple parties.
Jul 23, 2026