Loading malware…
Spirals is a previously unseen Rust-based ransomware family observed in a June 2026 double-extortion intrusion against an IT services company in South Asia. In the documented case, the operators compromised an internet-facing Microsoft IIS server, deployed an ASP.NET web shell, and rapidly progressed through hands-on-keyboard post-compromise activity to enterprise-wide encryption in less than 24 hours. The intrusion included privilege escalation via UAC bypass, credential theft through SAM and LSASS dumping, persistence through local account creation and remote access enablement, and lateral movement using WMI and PsExec. The operators also established covert access channels with tunneling and proxy tooling and disabled or impaired defenses before encryption by turning off Microsoft Defender protections and stopping backup, database, and virtualization services. Spirals encrypts files with a unique AES-128 key per file, with each key protected using an attacker-controlled ECDH P-256 public key, and uses intermittent encryption on larger files to accelerate impact. The operation followed a double-extortion model, combining file encryption with data theft and threats to publish stolen information within days if payment was not made. Attribution to a known threat actor has not been established, and public reporting has so far tied Spirals to a single victim environment, though the operators were assessed as skilled and capable of broader campaigns.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
They successfully hit over a dozen machines within minutes using compromised domain administrator credentials
Mis en place un accès distant covert
Accès initial : compromission d’un serveur web IIS exposé sur Internet
Lateral movement and deployment Movement began the same night over WMI.
That shell let them spawn cmd.exe and PowerShell through the IIS worker process.
A base64-encoded PowerShell payload went out to machine after machine.
They then used PsExec running as SYSTEM to distribute the ransomware across the network...
They successfully hit over a dozen machines within minutes using compromised domain administrator credentials
Mis en place un accès distant covert
Next, they enabled RDP and created a local account for persistence.
Attackers compromised an internet-facing IIS web server and uploaded an ASP.NET web shell.
They successfully hit over a dozen machines within minutes using compromised domain administrator credentials
A token impersonation tool followed shortly after, which likely enabled privilege escalation.
Within a three-hour session, the operator escalated privileges through a UAC bypass.
A base64-encoded PowerShell payload went out to machine after machine.
The payload masqueraded as bitsadmin.exe, a real Windows tool... In some cases, the files wore .jpg extensions as a disguise.
A PowerShell payload disabled Microsoft Defender, removed its threat definitions...
They successfully hit over a dozen machines within minutes using compromised domain administrator credentials
A token impersonation tool followed shortly after, which likely enabled privilege escalation.
credential harvesting via LSASS dumps (using rundll32.exe and comsvcs.dll)
It first disabled Windows Defender, then killed 23 backup, database, and virtualization services so files sat unlocked for encryption.
Credential theft came next. The attackers dumped the SAM hive into a password-protected archive. Later, they dumped LSASS memory on several machines using living-off-the-land binaries.
Later, they dumped LSASS memory on several machines using living-off-the-land binaries.
Credential theft came next. The attackers dumped the SAM hive into a password-protected archive.
This let them set up covert remote access before later deploying the ransomware payload across the network...
Next, they enabled RDP and created a local account for persistence.
The next day, they switched to PsExec running as SYSTEM.
The operators then used PsExec, running as SYSTEM, to push the same PowerShell payload to a long list of hosts
It was staged across multiple network locations, including the SYSVOL domain scripts directory, ensuring automated propagation even to machines not directly targeted by the PsExec script.
They ran a reverse-SOCKS proxy to an external IP on port 443.
used ... reverse tunnels to establish persistence
Tools arrived from one external IP and two staging domains.
This double extortion campaign then leaned on stolen data for pressure.
progressing from initial access to data theft and network-wide encryption in less than 24 hours
Spirals employs a double-extortion model, threatening to leak stolen data in addition to encrypting files
The attackers hit a South Asian IT services firm and encrypted its network in under 24 hours.
then killed 23 backup, database, and virtualization services so files sat unlocked for encryption.
stopped services tied to 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL
T1657 — Financial Theft (Impact)
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.