NightSpire Ransomware — Go-Based Encryptor with .nspire Extension, RDP-First Intrusions, and Living-off-the-Land Tradecraft (Picus, Huntress, SonicWall, Broadcom) — Threadlinqs Intelligence
As of 2026-05-30, NightSpire Ransomware — Go-Based Encryptor with .nspire Extension, RDP-First Intrusions, and Living-off-the-Land Tradecraft (Picus, Huntress, SonicWall, Broadcom) is a high-severity ransomware threat attributed to NightSpire, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0571 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: NightSpire · FINANCIAL
NightSpire is a double-extortion ransomware family first identified in February 2025 that has compromised at least 64 organizations across 33 countries between March and June 2025, with the United
NightSpire is an emerging ransomware family first observed in February 2025 and tracked publicly from early 2025 through 2026 by Picus Security, Huntress, SonicWall, and Broadcom. The operators run a classic double-extortion playbook: stage and exfiltrate sensitive data before encrypting endpoints, then threaten to leak the stolen files on a Tor-based leak site if victims refuse to pay. Between March and June 2025 the group hit at least 64 organizations across 33 countries, with the U.S. leading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt. Targeted verticals include healthcare, education, government, finance, manufacturing, hospitality, IT services, and logistics — a deliberately broad targeting profile consistent with opportunistic ransomware operators.
Whether NightSpire is run as a Ransomware-as-a-Service (RaaS) is contested. Halcyon reported in July 2025 that operations are kept in-house with no affiliate program ('a closed shop'), while HivePro reported two months later that NightSpire is operating under a RaaS model. Huntress notes that this divergence is consistent with significant TTP variation observed between distinct intrusions, including changes to the ransom note filename and content ('_nightspire_readme.txt' in December 2025 vs. '[nspire_msg].txt' in March 2026) and the encryptor SHA256 across samples — behavior characteristic of either an evolving in-house tool or multiple affiliates handling different intrusions.
Initial Access: In observed intrusions the threat actor reached endpoints over Remote Desktop Protocol (RDP), consistent with credential reuse, brute force, or purchased access from initial access brokers. No CVE exploitation has been publicly attributed to the operators.
Persistence: Rather than develop bespoke persistence mechanisms, operators install legitimate remote administration software. Chrome Remote Desktop was deployed on at least two compromised machines, registering a Windows service named 'Chrome Remote Desktop Service' running C:\Program Files (x86)\Google\Chrome Remote Desktop\147.0.7727.3\remoting_host.exe with --type=daemon --host-config=... arguments tied to the Google account prince1990905@gmail.com. AnyDesk was installed on a separate endpoint, registering both an 'AnyDesk Service' Windows service and an anydesk.lnk shortcut in the Startup folder for boot persistence. Huntress also observed VMware Workstation and WPS Office (Kingsoft) being staged on compromised endpoints.
Discovery and Collection: Operators ran Everything by voidtools — a freeware file-indexing tool — to enumerate sensitive files across local and mapped drives interactively via its GUI. Huntress reconstructed the lineage of file access decisions through Everything's process tree.
Staging and Exfiltration: 7-Zip was used to compress targeted folders into password-protected ZIP archives (typical syntax: 7z.exe a -tzip -p<PASSWORD> -mx5 C:\Users\<USER>\Downloads\data.zip ...). MEGAsync (C:\Users\<USER>\AppData\Local\MEGAsync\MEGAsync.exe /upload ...) then uploaded those archives to MEGA cloud storage. The threat actor's ops folder in the March 2026 intrusion was C:\Users\[REDACTED]\Downloads\.
Encryption: The NightSpire encryptor is a portable executable written in Go (enc.exe). Go's statically linked binaries enable cross-platform compilation for Windows, Linux, and macOS, and produce characteristic large binaries with identifiable strings. On execution the encryptor opens a console via conhost.exe, walks every accessible drive and path, builds a target file list, encrypts each file, and appends a .nspire extension to the original filename. A ransom note is dropped into every directory containing encrypted files. Two ransom-note filenames have been observed: _nightspire_readme.txt (December 2025) and [nspire_msg].txt (March 2026). SHA256 hashes for two encryptor samples are documented: bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355 (2 Dec 2025) and
Target sectors: healthcare, education, government, finance, manufacturing, hospitality, it-services, logistics
Target regions: North America, Europe, Asia, Latin America, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1133, T1078, T1204, T1059, T1543, T1547, T1036, T1070, T1083, T1082