Spirals

Spirals is a financially motivated ransomware actor associated with the Rust-based Spirals ransomware family, first observed in June 2026. Its operations combine data theft and encryption with threats to publish stolen information unless victims pay. Reported targets include IT services, maritime services, logistics, healthcare, and financial-services organizations. Named victims include Seven Seas Group in the United Kingdom, ASYAD Group in Oman, Armada Credit Bureau in Uganda, and PITTSRAD and ANYTHINGIT in the United States. In a documented intrusion against an IT services firm in South Asia, Spirals progressed from initial access to data theft and ransomware deployment in less than 24 hours. The attackers compromised an internet-facing Microsoft IIS server and deployed an ASP.NET web shell. They bypassed User Account Control, enabled Remote Desktop, created a local account for persistence, and attempted credential extraction by dumping the SAM registry hive and LSASS memory. Network reconnaissance and lateral movement relied on legitimate administrative mechanisms, including WMI and PsExec. Redundant remote-access channels used revsocks, Chisel, and Cloudflare tunnels. Before encryption, the attackers attempted to remove security software, disabled Microsoft Defender, removed its threat definitions, and stopped services associated with backup, database, and virtualization products. They distributed the ransomware using PsExec running as SYSTEM. Spirals uses AES-128 encryption with keys protected through ECDH P-256 and intermittent encryption for files larger than 5 MB. In the documented intrusion, the attackers threatened to publish stolen data within six days if payment was not made.