New Rust-based ransomware targets Linux systems.

In Q1 2025, a new Rust-based ransomware variant, dubbed 'LockBit-Rust' (unofficial), hit Linux servers across fintech and healthcare sectors, encrypting files in under 30 seconds per host. Unlike its predecessors, this malware uses raw syscalls via Rust's `libc` crate to evade EDR hooks, and leverages the `io_uring` interface for asynchronous I/O to bypass traditional file monitoring. We've seen this in three of our recent incident response engagements at CybernytronX. This post dissects its internals, maps its TTPs to MITRE ATT&CK, and provides a concrete detection and mitigation playbook for your Linux fleet.

Real-World Context: The Rust Shift in Ransomware

Ransomware operators are abandoning C/C++ for Rust due to memory safety and cross-compilation ease. The LockBit group (and affiliates like BlackCat/ALPHV) have experimented with Rust variants since 2023, but this new Linux target is distinct. It specifically targets enterprise Linux distributions (Ubuntu 22.04, RHEL 9, CentOS 7) running critical services like Nginx, PostgreSQL, and Docker. In one incident, the attacker used a compromised SSH key to gain initial access (T1078.002), then deployed the ransomware via a cron job (T1053.003). The binary itself is statically linked, making it portable across glibc versions.

Attacker TTPs: Step-by-Step Technical Breakdown

Initial Access and Persistence

The attack chain often starts with an exposed SSH service or a vulnerable web application. For example, CVE-2023-48795 (a Terrapin SSH vulnerability) was used in one campaign to downgrade SSH connections and capture credentials. Once inside, the attacker uses `curl` or `wget` to download the Rust binary from a pastebin-like site or a compromised S3 bucket. Persistence is achieved through systemd services (T1543.002) that restart the ransomware on boot.

Encryption Mechanism

The ransomware uses the `ring` crate for ChaCha20-Poly1305 encryption, with a per-file key generated via `getrandom` syscall. The master key is encrypted with Curve25519 ECDH and exfiltrated to a C2 server. Unlike typical ransomware, it avoids encrypting system files in `/proc`, `/sys`, and `/dev` to prevent system crashes. It targets specific file extensions: `.conf`, `.sql`, `.pem`, `.key`, `.env`, `.log`. The encryption is fast—our tests showed 100 MB/s on an NVMe SSD—due to Rust's zero-cost abstractions and the use of `mmap` for direct file I/O.

Evasion Techniques

This variant uses direct syscalls (via `libc::syscall`) to bypass `ptrace`-based EDR hooks. It also checks for common sandbox indicators: /proc/self/status for `TracerPid` (T1057), and lscpu for CPU core count (if less than 2, it exits). The binary is packed with UPX, but the unpacked version reveals clear strings like 'encrypted' and 'README.txt'.

Defensive Playbook: How to Protect Your Linux Fleet

Prevention

• Harden SSH: Disable root login, use key-based auth with FIDO2 tokens, and apply CVE-2023-48795 patches immediately.
• Restrict Execution: Use SELinux or AppArmor to block binaries from non-standard paths (e.g., `/tmp` or `/dev/shm`).
• Monitor Syscalls: Deploy eBPF-based tools like Falco to alert on suspicious syscall patterns (e.g., `io_uring` usage by non-database processes).

Detection Rules

Here's a YARA rule to detect the LockBit-Rust variant:

rule LockBit_Rust_Linux {
  meta:
    description = "Detects LockBit-Rust ransomware binary"
    author = "Ammar Khan, CybernytronX"
    date = "2025-03-01"
  strings:
    $s1 = "encrypted" ascii wide
    $s2 = "README.txt" ascii wide
    $s3 = "ChaCha20" ascii wide
    $s4 = { 48 31 c0 48 8d 3d } // mov rax, 0; lea rdi, [rip+...]
  condition:
    all of ($s*) and filesize < 5MB
}

For Sigma, create a rule for file system events with extension `.encrypted` in non-standard directories:

title: Linux Ransomware File Extension Detection
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'file_write'
    name|endswith: '.encrypted'
    path|contains: '/home' or '/var/www'
  condition: selection

Incident Response

If you detect the ransomware, immediately isolate the host (use `iptables` to drop all outbound traffic except to your SIEM). Extract the binary for analysis—use `strings` and `objdump` to find the C2 IP. In our engagements, the C2 often uses HTTPS with a self-signed certificate. Block the IP at the firewall and rotate all credentials on the affected system.

Why This Matters for Your Org

Linux servers are the backbone of cloud infrastructure, and this ransomware targets them specifically to disrupt operations. The Rust-based approach means traditional signature-based AV will miss it. Your SOC must shift to behavioral detection—focus on file encryption patterns, abnormal syscall usage, and lateral movement via SSH. At CybernytronX, we've integrated these indicators into our Ethereon AI platform to provide real-time threat hunting. If you're running Linux in production, this isn't a future threat—it's here now.

Frequently Asked Questions

How does Rust-based ransomware differ from traditional Linux ransomware?

Rust-based variants are harder to reverse-engineer due to LLVM optimizations, use direct syscalls to evade EDR, and leverage modern crypto libraries like `ring` for fast encryption. They also have better cross-platform compatibility without recompilation.

Can existing Linux antivirus detect this ransomware?

Not reliably. Signature-based AV (like ClamAV) will miss it if the binary is packed or polymorphic. Behavioral detection via eBPF (Falco) or EDR with syscall monitoring is essential.

What are the first steps if I suspect a Linux ransomware infection?

Isolate the host immediately—disconnect network, kill the process with `kill -9`, and capture a memory dump with `lime`. Then, analyze the binary with `strings` and `objdump` to find C2 indicators, and rotate all credentials.

How can I prevent ransomware from using direct syscalls?

Use eBPF-based tools like Falco to monitor `syscall` events from non-whitelisted processes. You can also deploy a kernel module that restricts `io_uring` to specific system users or groups.

Is this ransomware targeting specific Linux distributions?

Yes, it primarily targets Ubuntu 22.04, RHEL 9, and CentOS 7 due to their prevalence in enterprise environments. However, the binary is statically linked, so it can run on any glibc-based distribution.

What role does Rust's memory safety play in ransomware development?

Rust prevents common vulnerabilities like buffer overflows, making the ransomware more stable and less likely to crash during encryption. This increases the success rate for attackers and complicates exploitation by defenders.

Need expert help with this?

At CybernytronX, we've dissected this Rust ransomware in our lab and built detection playbooks for our clients. If your Linux fleet needs a security audit or real-time threat hunting, our team can help. We offer penetration testing, SOC automation, and our Ethereon AI platform that detects such threats in minutes. Contact us for a consultation, or learn more about Ethereon AI to see how we can protect your infrastructure.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.