NightSpire Ransomware — Go-Based Encryptor with .nspire Extension, RDP-First Intrusions, and Living-off-the-Land Tradecraft (Picus, Huntress, SonicWall, Broadcom)
NightSpire Ransomware (TL-2026-0571), also tracked as NightSpire, is a high-severity ransomware operation, first published 2026-05-23. It is attributed to NightSpire with medium confidence, affects Microsoft Windows (endpoints and servers), maps to 22 MITRE ATT&CK techniques (T1005, T1036, T1039), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0571
- Threat ID
- TL-2026-0571
- Also known as
- NightSpire, Operation NightSpire
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-05-23
- Last reviewed
- 2026-05-23
- Attribution
- NightSpire
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- healthcare, education, government, finance, manufacturing, hospitality, it-services, logistics
- Target regions
- North America, Europe, Asia, Latin America, Middle East
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in NightSpire Ransomware
Malware and tooling: nightspire, 7-Zip, AnyDesk, Chrome Remote Desktop, Everything (voidtools), MEGAsync, VMware Workstation, WPS Office (Kingsoft)
NightSpire is a double-extortion ransomware family first identified in February 2025 that has compromised at least 64 organizations across 33 countries between March and June 2025, with the United States topping the victim list. The Go-based encryptor appends a .nspire extension, drops a ransom note in every directory containing encrypted files, and notably also encrypts OneDrive-synced files in the cloud without altering their extensions. Operators reach endpoints via Remote Desktop Protocol, install legitimate remote administration tools (Chrome Remote Desktop, AnyDesk) for persistence, use Everything (voidtools), 7-Zip, and MEGAsync for discovery, staging, and exfiltration to MEGA cloud storage, and leak data on a Tor-based site if victims refuse to pay.
How NightSpire Ransomware works
NightSpire is an emerging ransomware family first observed in February 2025 and tracked publicly from early 2025 through 2026 by Picus Security, Huntress, SonicWall, and Broadcom. The operators run a classic double-extortion playbook: stage and exfiltrate sensitive data before encrypting endpoints, then threaten to leak the stolen files on a Tor-based leak site if victims refuse to pay. Between March and June 2025 the group hit at least 64 organizations across 33 countries, with the U.S. leading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt. Targeted verticals include healthcare, education, government, finance, manufacturing, hospitality, IT services, and logistics — a deliberately broad targeting profile consistent with opportunistic ransomware operators.
Whether NightSpire is run as a Ransomware-as-a-Service (RaaS) is contested. Halcyon reported in July 2025 that operations are kept in-house with no affiliate program ('a closed shop'), while HivePro reported two months later that NightSpire is operating under a RaaS model. Huntress notes that this divergence is consistent with significant TTP variation observed between distinct intrusions, including changes to the ransom note filename and content ('_nightspire_readme.txt' in December 2025 vs. '[nspire_msg].txt' in March 2026) and the encryptor SHA256 across samples — behavior characteristic of either an evolving in-house tool or multiple affiliates handling different intrusions.
Initial Access: In observed intrusions the threat actor reached endpoints over Remote Desktop Protocol (RDP), consistent with credential reuse, brute force, or purchased access from initial access brokers. No CVE exploitation has been publicly attributed to the operators.
Persistence: Rather than develop bespoke persistence mechanisms, operators install legitimate remote administration software. Chrome Remote Desktop was deployed on at least two compromised machines, registering a Windows service named 'Chrome Remote Desktop Service' running C:\Program Files (x86)\Google\Chrome Remote Desktop\147.0.7727.3\remoting_host.exe with --type=daemon --host-config=... arguments tied to the Google account prince1990905@gmail.com. AnyDesk was installed on a separate endpoint, registering both an 'AnyDesk Service' Windows service and an anydesk.lnk shortcut in the Startup folder for boot persistence. Huntress also observed VMware Workstation and WPS Office (Kingsoft) being staged on compromised endpoints.
Discovery and Collection: Operators ran Everything by voidtools — a freeware file-indexing tool — to enumerate sensitive files across local and mapped drives interactively via its GUI. Huntress reconstructed the lineage of file access decisions through Everything's process tree.
Staging and Exfiltration: 7-Zip was used to compress targeted folders into password-protected ZIP archives (typical syntax: 7z.exe a -tzip -p<PASSWORD> -mx5 C:\Users\<USER>\Downloads\data.zip ...). MEGAsync (C:\Users\<USER>\AppData\Local\MEGAsync\MEGAsync.exe /upload ...) then uploaded those archives to MEGA cloud storage. The threat actor's ops folder in the March 2026 intrusion was C:\Users\[REDACTED]\Downloads\.
Encryption: The NightSpire encryptor is a portable executable written in Go (enc.exe). Go's statically linked binaries enable cross-platform compilation for Windows, Linux, and macOS, and produce characteristic large binaries with identifiable strings. On execution the encryptor opens a console via conhost.exe, walks every accessible drive and path, builds a target file list, encrypts each file, and appends a .nspire extension to the original filename. A ransom note is dropped into every directory containing encrypted files. Two ransom-note filenames have been observed: _nightspire_readme.txt (December 2025) and [nspire_msg].txt (March 2026). SHA256 hashes for two encryptor samples are documented: bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355 (2 Dec 2025) and ad67031e2ca68764fe1a7d6632c02b02a299d59efb920710011a9a2ccf4399b7 (25 Mar 2026).
Cloud Impact: A defining characteristic of NightSpire is that it also encrypts OneDrive-synced files in cloud storage without changing the file extension. The ransom note explicitly calls this out: 'REMEMBER! We also locked files in OneDrive. And we did not change the extensions of files in OneDrive.' This effectively defeats common assumptions that cloud-backed files are protected against ransomware impact, since the encryption occurs on the synced local copy and propagates via the OneDrive sync engine to the cloud copy.
Detection Priorities: NightSpire intrusions are entirely living-off-the-land outside the encryptor itself. Detection coverage should center on: anomalous installation of Chrome Remote Desktop / AnyDesk on servers that normally do not run them; creation of services named 'Chrome Remote Desktop Service' or 'AnyDesk Service' outside expected change windows; anydesk.lnk appearing in user Startup folders; presence of Everything.exe, 7z.exe, and MEGAsync.exe under user-writable directories like C:\Users\...\Downloads\; mass file rename events appending .nspire; and ransom-note file creation matching _nightspire_readme.txt or [nspire_msg].txt. Network telemetry should flag uploads to mega.nz / mega.io domains and outbound to Chrome Remote Desktop relay infrastructure (remoting-pa.googleapis.com) from servers.
MITRE ATT&CK techniques used in TL-2026-0571
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive; T1530 Data from Cloud Storage; T1560 Archive Collected Data
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1657 Financial Theft
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in NightSpire Ransomware
- Microsoft — Windows (endpoints and servers)
Vulnerable versions: all currently supported versions reachable via RDP - Microsoft — OneDrive Sync Client
Vulnerable versions: all versions — synced local files are encrypted and propagated to cloud copies - Linux — Linux distributions (potential — Go encryptor is cross-platform; primary observed impact on Windows)
Vulnerable versions: any - Apple — macOS (potential — Go encryptor is cross-platform; not observed in public reporting)
Vulnerable versions: any
Remediation for NightSpire Ransomware
Patches
- No CVE patch applies — NightSpire intrusions are credential-driven via RDP, not exploit-driven. Apply Windows and remote-access vendor patches as part of routine hygiene.
Immediate actions
- Audit Windows services for 'Chrome Remote Desktop Service' and 'AnyDesk Service' on systems that should not run remote-admin software; remove unauthorized instances
- Block or alert on installation of Chrome Remote Desktop (remoting_host.exe), AnyDesk, Everything (voidtools), 7-Zip, MEGAsync, VMware Workstation, and WPS Office on servers and non-IT user endpoints
- Restrict outbound traffic to MEGA cloud storage (mega.nz, mega.io, mega.co.nz, *.userstorage.mega.co.nz) at the proxy/firewall for environments where MEGA is not an approved tool
- Disable or strictly restrict inbound RDP from the internet; require MFA for all remote access and enforce account lockout
- Hunt OneDrive sync clients for mass file rename events and the .nspire extension; quarantine affected hosts and pause OneDrive sync to prevent cloud propagation
- Use OneDrive / SharePoint version history and file restore to recover OneDrive content if encrypted (cloud-side version retention is the primary recovery path for OneDrive-encrypted data)
Workarounds
- Block remoting-pa.googleapis.com and Chrome Remote Desktop relay endpoints at the proxy where the tool is not sanctioned
- Disable Windows Startup folder execution via Group Policy where feasible
- Configure OneDrive 'Known Folder Move' with versioning retention sufficient to survive a mass encryption event (90+ days)
- Disable cmd.exe and PowerShell on accounts that have no business need; restrict Everything, 7-Zip, and MEGAsync via AppLocker / WDAC
Longer-term hardening
- Deploy EDR with detection coverage for service creation events (Windows Event ID 7045), Startup folder LNK persistence, and mass file rename behavioral signatures
- Implement application allow-listing on servers to block execution of Everything.exe, 7z.exe, MEGAsync.exe, AnyDesk.exe, and Chrome Remote Desktop binaries from user-writable paths
- Adopt a zero-trust posture for RDP: brokered access through a privileged access management (PAM) solution, no direct inbound RDP, phishing-resistant MFA, and JIT elevation
- Segment OneDrive / cloud-storage write paths so ransomware-encrypted local files cannot mass-propagate to all corporate cloud storage tenants
- Test ransomware tabletop scenarios that include cloud-backed file destruction and rehearse OneDrive / SharePoint restore workflows
- Maintain immutable, offline backups; verify restore times monthly
Timeline of NightSpire Ransomware
- NightSpire ransomware family first identified in the wild (per Huntress reporting referencing February 2025 emergence).
- Documented campaign window begins: NightSpire compromises start being tracked at scale across multiple countries and verticals.
- By mid-2025, at least 64 organizations across 33 countries have been compromised; U.S., Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt lead the victim count.
- Halcyon publishes analysis arguing NightSpire is not RaaS — 'a closed shop' with no public affiliate program.
- HivePro reports that NightSpire is operating under a Ransomware-as-a-Service (RaaS) model, contradicting earlier Halcyon analysis and suggesting either an evolution of the group or affiliate involvement.
- Huntress observes first NightSpire customer incident: enc.exe SHA256 bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355, ransom note '_nightspire_readme.txt', .nspire extension on encrypted files.
- Second Huntress-observed incident: enc.exe SHA256 ad67031e2ca68764fe1a7d6632c02b02a299d59efb920710011a9a2ccf4399b7, ransom note renamed '[nspire_msg].txt', RDP initial access, Chrome Remote Desktop and AnyDesk persistence, prince1990905@gmail.com tied to Google account, Everything/7-Zip/MEGAsync used for staging and exfiltration, VMware Workstation and WPS Office staged on endpoints.
- Huntress publishes 'Leveling Up with NightSpire Ransomware' detailing TTPs and noting IoC variation between incidents — supporting either evolution or affiliate involvement.
- SonicWall and Broadcom publish reporting on NightSpire emphasizing OneDrive-synced file encryption and bulletin-level protection guidance.
- Picus Security publishes detailed NightSpire attack chain blog by Umut Bayram, integrated into Picus Threat Library as threats 79926 (Download) and 95001 (Email).
- As of 2026-05-29, NightSpire ransomware remains highly active and escalating, with its leak site claiming ~275 victims and a fresh posting on 2026-05-26, plus new vendor reporting from Picus (May 23) and Barracuda (May 1). No takedown, arrest, or disruption has occurred; the credential/RDP-driven, no-CVE operation is an ongoing live threat.
Sources cited for NightSpire Ransomware
- NightSpire Ransomware Attack Chain, Tools and Tactics (Picus, Umut Bayram)
- Leveling Up with NightSpire Ransomware — Decoding NightSpire: Ransomware IOCs aren't set in stone (Huntress, Carvey & O'Donnell-Welch)
- NightSpire ransomware encrypts cloud-stored OneDrive files (SonicWall)
- NightSpire Ransomware (Broadcom Protection Bulletin)
- MITRE ATT&CK — T1133 External Remote Services
- MITRE ATT&CK — T1486 Data Encrypted for Impact
- MITRE ATT&CK — T1567.002 Exfiltration to Cloud Storage
- voidtools Everything — file-indexing utility used by operators for discovery
Threats related to NightSpire Ransomware
- Foxconn North American Factories Cyberattack — Nitrogen Ransomware Claims 8 TB / 11M+ Documents Stolen, Including Network Topologies for AMD/Intel/Google
- KryBit Ransomware-as-a-Service Strikes Back — Breaches 0APT Infrastructure Amid Faux-Ransomware Feud (May 2026)
- Trigona Ransomware Affiliates Deploy Custom Exfiltration Tool 'TriStealer' for Pre-Ransomware Data Theft
- Krybit Ransomware — Babuk-Derived RaaS Operation Emerges with Double Extortion
Detection coverage for TL-2026-0571
As of 2026-05-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0571 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.