New Spirals ransomware encrypts victim network in under 24 hours

1. Executive summary

A new ransomware actor dubbed "Spirals" completed a full intrusion cycle — from initial access through data theft to file encryption — in under 24 hours against an IT services firm in South Asia. The attack, observed by Symantec's Threat Hunter Team in June 2026, began by compromising an Internet-exposed IIS server and deploying an ASP.NET web shell. The Rust-based ransomware payload uses AES-128 encryption with ECDH P-256 key protection and intermittent encryption for files over 5 MB. Attribution to the actor "Spirals" is unconfirmed: the named actor has no MITRE ATT&CK profile, and Symantec has observed this family in only a single case so far, leaving open whether it is a broadly deployed strain or a custom payload. EMEA financial services firms with internet-facing IIS infrastructure and weak RDP/account controls should treat the attack chain as a validated playbook and prioritise detection coverage for the described behaviours.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: The actor "Spirals" has no MITRE ATT&CK profile in the verified reference data. Attribution rests solely on Symantec's single-case report. Treat the actor name and all associated indicators as unconfirmed pending corroboration.

Attack chain (confirmed steps from Symantec reporting)

1. Initial access — The attacker compromised an Internet Information Services (IIS) server exposed on the public web at an IT services firm in South Asia.
2. Web shell deployment — An ASP.NET web shell was uploaded to the compromised IIS server, providing interactive access.
3. Privilege escalation / UAC bypass — The operator bypassed User Account Control (UAC) to elevate privileges on the host.
4. Persistence — The attacker enabled Remote Desktop and created a local account to maintain persistent access.
5. Credential theft — The SAM registry hive was dumped and LSASS process memory was captured in an attempt to extract credentials.
6. Defence evasion — A PowerShell payload disabled Microsoft Defender and removed its threat definitions. The same payload stopped services associated with 23 backup, database, and virtualization products, including: Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL.
7. Lateral movement — The attacker used WMI to move laterally to more than a dozen systems.
8. Redundant C2 / remote access — Multiple remote access channels were established using revsocks, Chisel, and Cloudflare tunnels.
9. Data theft — Data was exfiltrated prior to encryption (extent and method not detailed in source).
10. Payload deployment — The ransomware payload was deployed via PsExec running as SYSTEM. The payload binary was named bitsadmin.exe, masquerading as the legitimate Windows Background Intelligent Transfer Service utility. Deployment occurred less than 24 hours after initial compromise.
11. Encryption — The Spirals payload (Rust-based) encrypted files across impacted machines using AES-128 keys protected by an attacker-controlled ECDH P-256 public key. Files larger than 5 MB were subject to intermittent encryption to accelerate the process.
12. Extortion — A ransom note named RECOVERY_SECTION.log was dropped on the C:\ drive containing negotiation instructions. Victims are threatened with public exposure of stolen data within six days if the ransom is not paid.

Single-source confidence caveat: This entire attack chain is drawn from a single Symantec Threat Hunter Team report documenting one incident. There is no independent corroboration of the Spirals actor, the malware family, or the IOCs at time of writing. Verify before enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Internet-facing IIS servers: Audit all externally exposed IIS installations. Restrict access via WAF/reverse proxy; enforce authentication on all virtual directories; remove unnecessary ASP.NET handler mappings if web shell upload is a concern. Patch IIS to current supported versions.
• Block known C2 tooling: Create EDR / endpoint firewall rules to block execution of revsocks.exe and chisel.exe (and variants). Monitor for and block outbound Cloudflare tunnel client binaries (e.g., cloudflared.exe) unless explicitly authorised in the environment.
• Detect PsExec deployment: Alert on PsExec service creation (PSEXESVC) originating from non-administrative workstations or unexpected hosts, particularly when the executing process is named bitsadmin.exe running as SYSTEM.
• Hunt for web shells: Scan IIS web roots for newly created .aspx / .asp files; correlate with IIS W3SVC logs showing POST requests to unusual paths.

P2 — within 72 hours

• Credential-dumping detection: Ensure EDR rules alert on LSASS memory access by unauthorised processes and on attempts to copy/save the SAM registry hive (e.g., reg save HKLM\SAM). Enable LSA Protection (RunAsPPL) where supported.
• Defender tamper protection: Enable Tamper Protection in Microsoft Defender to prevent programmatic disabling of real-time protection and definition removal via PowerShell.
• Backup service hardening: Audit service ACLs and GPOs for the 23 product families referenced (Veeam, VMware, Hyper-V, SQL Server, Oracle, PostgreSQL, and others). Restrict service stop permissions to authorised admin accounts only. Monitor for bulk service-stop events via PowerShell.
• RDP / local account creation monitoring: Alert on RDP being enabled via registry or PowerShell (Set-ItemProperty on fDenyTSConnections) and on new local account creation outside of documented provisioning workflows.
• WMI lateral movement detection: Monitor WMI event subscriptions and remote WMI connections (wmic.exe, WmiPrvSE.exe) originating from unexpected hosts.

P3 — within 7 days

• UAC bypass hardening: Enable UAC virtualisation and set UAC to "Always Notify" on critical servers. Review EDR coverage for known UAC bypass techniques (e.g., fodhelper, eventvwr).
• Network segmentation review: Validate that IIS-facing DMZ segments are isolated from internal management networks to slow lateral movement via WMI and PsExec.
• Tabletop / purple-team exercise: Run a simulation of the Spirals attack chain (IIS compromise → web shell → UAC bypass → credential dump → WMI spread → PsExec payload) against detection infrastructure to validate coverage.

5. Indicators of compromise

The Symantec report references network indicators and file hashes associated with the documented attack, but the specific indicator values were not included in the source material provided to Adverse Trace. No atomic indicators of compromise are available in the provided source text. Clients with access to the full Symantec Threat Hunter Team report should extract and operationalise the IOCs directly from that publication.

Behavioural indicators

6. Detection

rule Spirals_Ransomware_Payload {
    meta:
        author = "Adverse Trace"
        date = "2026-07-16"
        reference = "https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/"
        description = "Detects Spirals ransomware payload based on artefacts from Symantec report"
        confidence = "single-sourced; verify before enforcement"

    strings:
        $ransom_note = "RECOVERY_SECTION.log" ascii wide
        $payload_name = "bitsadmin.exe" ascii wide

    condition:
        1 of them
}

rule Spirals_C2_Tooling {
    meta:
        author = "Adverse Trace"
        date = "2026-07-16"
        reference = "https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/"
        description = "Detects C2 tunneling tools used in Spirals attack chain"

    strings:
        $tool1 = "revsocks" ascii
        $tool2 = "chisel" ascii

    condition:
        1 of them
}

title: Spirals Ransomware Attack Chain Behaviours
id: 7a3c1f2e-2026-7163-9b0d-adversetrace316
status: experimental
description: >
    Detects behavioural patterns associated with the Spirals ransomware attack chain:
    RDP enablement, local account creation, Defender disabling, bulk service stops,
    and PsExec deployment of masqueraded payload.
references:

    - https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/
author: Adverse Trace
date: 2026/07/16
tags:

    - attack.persistence
    - attack.defense_evasion
    - attack.lateral_movement
    - attack.credential_access
logsource:
    product: windows
    category: process_creation
detection:
    enable_rdp:
        CommandLine|contains:

            - "fDenyTSConnections"
            - "Set-ItemProperty"
        CommandLine|contains:

            - "TerminalServer"
    create_local_account:
        CommandLine|contains|all:

            - "net user"
            - "/add"
    disable_defender:
        CommandLine|contains:

            - "Set-MpPreference"
            - "DisableRealtimeMonitoring"
            - "RemoveDefinitions"
    stop_services:
        CommandLine|contains:

            - "Stop-Service"
            - "sc stop"
        CommandLine|contains:

            - "Veeam"
            - "VMware"
            - "Hyper-V"
            - "SQL"
            - "Oracle"
            - "PostgreSQL"
    dump_sam:
        CommandLine|contains:

            - "reg save"
            - "HKLM\\SAM"
    psexec_bitsadmin:
        Image|endswith:

            - "bitsadmin.exe"
        User|contains:

            - "SYSTEM"
    condition: enable_rdp or create_local_account or disable_defender or stop_services or dump_sam or psexec_bitsadmin
falsepositives:

    - Legitimate administrative scripts enabling RDP or creating local accounts
    - Authorised backup service maintenance windows
level: high

7. Sources

• BleepingComputer, "New Spirals ransomware encrypts victim network in under 24 hours," https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/, 2026-07-16
• Symantec Threat Hunter Team (referenced via BleepingComputer article above; original Symantec report URL not provided in source material)

8. Adverse Trace position

Severity: High — The Spirals attack chain demonstrates a rapid, end-to-end intrusion capability (under 24 hours from initial access to encryption) that is operationally significant for any organisation with internet-facing IIS infrastructure. The use of established living-off-the-land techniques (PsExec, WMI, PowerShell) combined with redundant C2 channels (revsocks, Chisel, Cloudflare tunnels) and targeted backup-service disruption makes this a credible and effective playbook. However, the assessment is single-sourced: all detail derives from one Symantec report documenting a single incident at one South Asian IT services firm. The actor "Spirals" has no MITRE ATT&CK profile and no independent corroboration exists at time of writing. It remains unclear whether this is a broadly deployed ransomware family or a custom one-off payload. EMEA financial services clients should prioritise detection coverage for the described behaviours (web shell deployment on IIS, UAC bypass, credential dumping, Defender tampering, bulk service stops, PsExec payload delivery) and treat internet-facing IIS servers as high-risk attack surface. Adverse Trace will monitor for additional Spirals incidents and update this advisory if corroboration emerges or if Symantec publishes the full IOC set.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.