Malware

Spirals Ransomware

Tracked since Jul 19, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK17Techniques

IOCs1Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1190Exploit Public-Facing ApplicationEvidence1

Attackers reportedly exploited an exposed Microsoft Internet Information Services (IIS) server accessible from the internet.

Execution

4 techniques

T1047Windows Management InstrumentationEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1059 – Command and Scripting Interpreter

T1059.001PowerShellEvidence1

Security teams may observe: PowerShell execution PsExec activity SMB communications RDP sessions Administrative credential usage

Persistence

5 techniques

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1112Modify RegistryEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1505.003Web ShellEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1543.003Windows ServiceEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Privilege Escalation

4 techniques

T1053Scheduled Task/JobEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1134Access Token ManipulationEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

T1543.003Windows ServiceEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Stealth

2 techniques

T1078Valid AccountsEvidence1

Once inside, the attackers rapidly established persistence using legitimate accounts and web shell access.

T1134Access Token ManipulationEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Possible techniques include: Web shells Scheduled tasks Service creation Registry modifications Valid credential abuse

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

Attackers likely leveraged credential harvesting, token manipulation, or existing privileged accounts to gain elevated permissions.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1083 – File and Directory Discovery

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1021 – Remote Services

T1021.001Remote Desktop ProtocolEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

T1021.002SMB/Windows Admin SharesEvidence1

Common movement techniques include: Remote Desktop Protocol (RDP) SMB PsExec Windows Management Instrumentation (WMI) Remote PowerShell

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1041 – Exfiltration Over Command and Control Channel

Impact

1 technique

T1486Data Encrypted for ImpactEvidence1

MITRE ATT&CK Mapping Observed behaviors align with several MITRE ATT&CK techniques: T1486 – Data Encrypted for Impact

Indicators of compromise

Observables

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyberthroneNews · Jul 19, 2026Spirals Ransomware Dissection - TheCyberThroneA newly identified ransomware family associated with rapid, highly automated intrusions that can compromise an enterprise, establish persistence, escalate privileges, move laterally, exfiltrate sensitive data, and encrypt systems in less than 24 hours, consistent with a double-extortion model.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching1Match every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Spirals Ransomware

Tracked since Jul 19, 2026 · Updated 3 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK17Techniques

IOCs1Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure