Malware

Spirals Ransomware

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1190Exploit Public-Facing ApplicationEvidence1

Attackers reportedly exploited an exposed Microsoft Internet Information Services (IIS) server accessible from the internet.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1059 – Command and Scripting Interpreter

T1059.001PowerShellEvidence1

Security teams may observe: PowerShell execution PsExec activity SMB communications RDP sessions Administrative credential usage

Persistence

5 techniques

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1112Modify RegistryEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1505.003Web ShellEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1543.003Windows ServiceEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Privilege Escalation

4 techniques

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1134Access Token ManipulationEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

T1543.003Windows ServiceEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Stealth

2 techniques

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1134Access Token ManipulationEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1083 – File and Directory Discovery

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1021 – Remote Services

T1021.001Remote Desktop ProtocolEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

T1021.002SMB/Windows Admin SharesEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1041 – Exfiltration Over Command and Control Channel

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1486 – Data Encrypted for Impact

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberthroneNews

Jul 19, 2026

Spirals Ransomware Dissection - TheCyberThrone

A newly identified ransomware family associated with rapid, highly automated intrusions that can compromise an enterprise, establish persistence, escalate privileges, move laterally, exfiltrate sensitive data, and encrypt systems in less than 24 hours, consistent with a double-extortion model.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Spirals Ransomware

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1190Exploit Public-Facing ApplicationEvidence1

Attackers reportedly exploited an exposed Microsoft Internet Information Services (IIS) server accessible from the internet.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1059 – Command and Scripting Interpreter

T1059.001PowerShellEvidence1

Security teams may observe: PowerShell execution PsExec activity SMB communications RDP sessions Administrative credential usage

Persistence

5 techniques

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1112Modify RegistryEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1505.003Web ShellEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1543.003Windows ServiceEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Privilege Escalation

4 techniques

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1134Access Token ManipulationEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

T1543.003Windows ServiceEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Stealth

2 techniques

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1134Access Token ManipulationEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1083 – File and Directory Discovery

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1021 – Remote Services

T1021.001Remote Desktop ProtocolEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

T1021.002SMB/Windows Admin SharesEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1041 – Exfiltration Over Command and Control Channel

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1486 – Data Encrypted for Impact

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyberthroneNews

Jul 19, 2026

Spirals Ransomware Dissection - TheCyberThrone

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.