A previously undocumented Rust-based ransomware family, Spirals, moved from initial access on an internet-facing Microsoft IIS server to network-wide encryption in under 24 hours, striking an IT services organization in South Asia with a double-extortion ransomware operation.
Spirals is a previously undocumented, Rust-based ransomware family deployed against an IT services company in South Asia in June 2026. First seen on June 16, 2026, the Spirals operators completed the entire intrusion — from initial access via an ASP.NET web shell on an internet-facing Microsoft IIS server to network-wide encryption using PsExec — in less than 24 hours, demonstrating an unusually rapid ransomware attack lifecycle.
The Spirals ransomware payload encrypts files using per-file AES-128 keys wrapped with an attacker-controlled ECDH P-256 public key, and applies intermittent encryption to files larger than 5 MB to accelerate the encryption process. The Spirals operation enforces a double-extortion model, threatening to publish stolen data on a Tor negotiation portal within a 6-day deadline if the ransom is not paid.
Targeted platforms and products in this Spirals ransomware attack include Microsoft IIS, ASP.NET, Microsoft Windows Defender, Microsoft Exchange, Microsoft Hyper-V, VMware, Veeam, Acronis, Veritas, Commvault, Microsoft SQL Server, Oracle, MySQL, PostgreSQL, Intuit, SAP, and Lotus Domino, reflecting the breadth of backup, database, virtualization, and business applications the Spirals operators disabled or targeted prior to encryption.
#1 Initial Access via IIS Web Shell and Tunneling
The Spirals operators gained initial access on June 16, 2026, by compromising an internet-facing Microsoft IIS web server and uploading an ASP.NET web shell. Through the IIS worker process, they spawned cmd.exe and PowerShell to run an interactive, hands-on-keyboard session. Within the first ten minutes, the Spirals operators deployed three network tunneling utilities — revsocks, Chisel, and a Cloudflare Tunnel client — under legitimate-looking directories to establish redundant encrypted outbound channels.
#2 Privilege Escalation and Defense Evasion
The operator bypassed User Account Control for local privilege escalation, enabled Remote Desktop Protocol, and created a local account for persistence. A token impersonation tool was used to acquire further elevated privileges, and endpoint security tools were targeted for uninstallation. Additional Spirals-related payloads were retrieved from external staging infrastructure, in some cases disguised with .jpg extensions to bypass content inspection.
#3 Credential Access and Lateral Movement
Credentials were harvested by dumping the Security Account Manager hive to a password-protected archive and, later, by dumping LSASS process memory on multiple machines. The Spirals attackers then used Windows Management Instrumentation (WMI) to move from the initial host to more than a dozen machines within minutes, leveraging accounts assessed as likely or built-in domain administrators. The automated cadence, consistent with scripted tooling, and Active Directory enumeration during the foothold phase appear to have produced the target list used for the subsequent mass ransomware deployment.
#4 Mass Deployment via PsExec
The next day, the operator switched to PsExec running as SYSTEM to push a base64-encoded PowerShell payload to domain controllers, file servers, application servers, virtual machines, and workstations. The payload disabled Windows Defender, removed its threat definitions, and stopped 23 backup, database, and virtualization services — including Exchange, Hyper-V, VMware, Veeam, SQL Server, Oracle, and PostgreSQL — to release file handles ahead of encryption.
#5 Encryption and Double-Extortion
The Rust-based Spirals payload was named bitsadmin.exe to masquerade as the legitimate Windows BITS utility, and dropped in domain-replicated locations to reach machines not directly targeted by PsExec. Files were encrypted with per-file AES-128 keys wrapped using an attacker-controlled ECDH P-256 public key, with intermittent encryption applied to files larger than 5 MB for speed. A ransom note threatened to publish stolen data after six days and directed victims to a Tor negotiation portal, confirming the double-extortion model of the Spirals ransomware attack.
