Loading story…
A previously unseen Rust-based ransomware family dubbed Spirals was used in a double-extortion attack against an IT services company in South Asia, with attackers moving from initial compromise to network-wide encryption in under 24 hours. Investigators said the intrusion began through a publicly exposed IIS web server, where the attackers deployed an ASP.NET web shell, then quickly established persistence, harvested credentials, escalated access, disabled security tools, and moved laterally across the environment.
The operators maintained covert access through multiple channels including RDP, revsocks, Chisel, and Cloudflare Tunnel, and pushed the ransomware broadly with PsExec and WMI. Symantec said Spirals encrypts files using AES-128 with an attacker-controlled ECDH P-256 public key, uses intermittent encryption for files larger than 5 MB, and drops a ransom note at C:\RECOVERY_SECTION.log; the note warned that stolen data would be published within six days if payment was not made. Researchers described the attack as notably fast and stealthy, while noting only one Spirals incident has been observed so far.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
On July 16, 2026, Symantec publicly reported the first known Spirals case and disclosed technical details including use of an ASP.NET web shell, PsExec and WMI for deployment, and revsocks, Chisel, and Cloudflare Tunnel for covert access. Symantec assessed the operators as skilled and noted it had observed only a single case so far.
In June 2026, a previously unseen Rust-based ransomware family called Spirals was deployed in a double-extortion attack against an IT services company in South Asia. The attackers compromised an internet-facing IIS server, established persistence, stole data, moved laterally, and encrypted the network in under 24 hours.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecyberveille.ch
Open sourcecommunity.gurucul.com
Open sourcethecyberthrone.in
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
**Sodinokibi**, also known as **REvil** and **BlueCrab**, was distributed through multiple intrusion paths while its operators and affiliates steadily refined payload delivery and defense evasion. Researchers documented infections delivered via malspam, spear-phishing, compromised websites, exposed or stolen **RDP** access, and exploitation of vulnerabilities including `CVE-2019-2725`, `CVE-2018-13379`, and `CVE-2019-11510`. In South Korea, attackers also abused vulnerable WordPress sites for **SEO poisoning**, planting fake forum pages that pushed victims to download ZIP archives containing malicious JavaScript, which then fetched additional scripts, launched PowerShell, loaded a .NET injector in memory, and executed the ransomware through a Delphi-based loader. The operation paired technical sophistication with aggressive monetization. Analysts reported frequent changes to JavaScript obfuscation, command-and-control paths, PowerShell execution methods, process injection techniques, and target process names to reduce antivirus detection, alongside logic to disable security tooling and delete **Volume Shadow Copies** before encryption. IBM described the group’s use of **Curve25519**, **ECDH**, **Salsa20**, **AES**, and **SHA-3** in its encryption workflow, as well as its **double-extortion** model of stealing data and threatening publication on **The Happy Blog**. The ransomware was linked to a broad affiliate ecosystem, represented **22%** of IBM X-Force incident response engagements in 2020, and was reported to heavily impact organizations in the United States, United Kingdom, Australia, and Canada.
Aug 14, 2026
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026