Data by ransomware.live Windows

Spirals

Spirals is a previously unseen Rust-based ransomware family observed in a June 2026 double-extortion intrusion against an IT services company in South Asia.

Profile source: Mallory

Spirals

Family profile

Spirals is a previously unseen Rust-based ransomware family observed in a June 2026 double-extortion intrusion against an IT services company in South Asia. In the documented case, the operators compromised an internet-facing Microsoft IIS server, deployed an ASP.NET web shell, and rapidly progressed through hands-on-keyboard post-compromise activity to enterprise-wide encryption in less than 24 hours. The intrusion included privilege escalation via UAC bypass, credential theft through SAM and LSASS dumping, persistence through local account creation and remote access enablement, and lateral movement using WMI and PsExec. The operators also established covert access channels with tunneling and proxy tooling and disabled or impaired defenses before encryption by turning off Microsoft Defender protections and stopping backup, database, and virtualization services. Spirals encrypts files with a unique AES-128 key per file, with each key protected using an attacker-controlled ECDH P-256 public key, and uses intermittent encryption on larger files to accelerate impact. The operation followed a double-extortion model, combining file encryption with data theft and threats to publish stolen information within days if payment was not made. Attribution to a known threat actor has not been established, and public reporting has so far tied Spirals to a single victim environment, though the operators were assessed as skilled and capable of broader campaigns.

Capabilities

Credential Theft
Defense Evasion
Exfiltration
Lateral Movement
Persistence
Post Exploitation
Privilege Escalation
Process Injection

Operational record

Recent claims

PITTSRAD

US / Healthcare

Sep 18, 2026

ANYTHINGIT

Technology

Sep 18, 2026

MITRE ATT&CK

Spirals in ATT&CK

35 distinct techniques

Techniques

35 techniques

T1505.003 Web Shell T1090 Proxy T1003.001 LSASS Memory T1047 Windows Management Instrumentation T1548.002 Bypass User Account Control T1562.001 Disable or Modify Tools T1027 Obfuscated Files or Information T1489 Service Stop T1059.001 PowerShell T1486 Data Encrypted for Impact T1021.001 Remote Desktop Protocol T1048 Exfiltration Over Alternative Protocol T1059 Command and Scripting Interpreter T1036 Masquerading T1136.001 Local Account T1003.002 Security Account Manager T1021.002 SMB/Windows Admin Shares T1562 Impair Defenses T1003 OS Credential Dumping T1105 Ingress Tool Transfer T1133 External Remote Services T1190 Exploit Public-Facing Application T1657 Financial Theft T1567 Exfiltration Over Web Service T1090.002 External Proxy T1537 Transfer Data to Cloud Account T1039 Data from Network Shared Drive T1134 Access Token Manipulation T1218 System Binary Proxy Execution T1078 Valid Accounts T1490 Inhibit System Recovery T1570 Lateral Tool Transfer T1021 Remote Services T1569.002 Service Execution T1070.004 File Deletion

Reporting

Research mentioning Spirals

Jul 22

Security Online Info

Spirals Ransomware Encrypts a Network in Under 24 Hours

A previously unseen Rust-based ransomware family dubbed Spirals was used in a double-extortion attack against an IT services company in South Asia, with attackers moving from initial compromise to network-wide encryption in under 24 hours. Investigators said the intrusion began through a publicly exposed IIS web server, where the attackers deployed an ASP.NET web shell, then quickly established persistence, harvested credentials, escalated access, disabled security tools, and moved laterally across the environment. The operators maintained covert access through multiple channels including RDP, revsocks, Chisel, and Cloudflare Tunnel, and pushed the ransomware broadly with PsExec and WMI. Symantec said Spirals encrypts files using AES-128 with an attacker-controlled ECDH P-256 public key, uses intermittent encryption for files larger than 5 MB, and drops a ransom note at C:\RECOVERY_SECTION.log; the note warned that stolen data would be published within six days if payment was not made. Researchers described the attack as notably fast and stealthy, while noting only one Spirals incident has been observed so far.

Jul 20

Gurucul Threat Research

Spirals: New Stealthy Ransomware Deployed Against Asian IT Company | Community Portal | Gurucul

Jul 20

Cyberveille

Nouveau ransomware Spirals déployé en double extorsion contre une entreprise IT en Asie du Sud | CyberVeille

Jul 19

Cyberthrone

Spirals Ransomware Dissection - TheCyberThrone

Jul 18

Cyber Security News

New Spirals Ransomware Uses IIS Web Shell and PsExec to Encrypt IT Firm in Under 24 Hours

Jul 17

Help Net Security

Spirals ransomware locks down victim systems in under 24 hours - Help Net Security

Jul 16

Scworld

Attackers execute a complete ransomware operation in under 24 hours | news | SC Media

Jul 16

Bleeping Computer

Spirals

Family profile

Capabilities

Operational record

Recent claims

PITTSRAD

ANYTHINGIT

Spirals in ATT&CK

Techniques

Research mentioning Spirals

Spirals Ransomware Encrypts a Network in Under 24 Hours

Spirals: New Stealthy Ransomware Deployed Against Asian IT Company | Community Portal | Gurucul

Nouveau ransomware Spirals déployé en double extorsion contre une entreprise IT en Asie du Sud | CyberVeille

Spirals Ransomware Dissection - TheCyberThrone

New Spirals Ransomware Uses IIS Web Shell and PsExec to Encrypt IT Firm in Under 24 Hours

Spirals ransomware locks down victim systems in under 24 hours - Help Net Security

Attackers execute a complete ransomware operation in under 24 hours | news | SC Media

New Spirals ransomware encrypts victim network in under 24 hours

We appreciate you