# NightSpire Ransomware — Go-Based Encryptor with .nspire Extension, RDP-First Intrusions, and Living-off-the-Land Tradecraft (Picus, Huntress, SonicWall, Broadcom)

> NightSpire is a double-extortion ransomware family first identified in February 2025 that has compromised at least 64 organizations across 33 countries between March and June 2025, with the United States topping the victim list. The Go-based encryptor appends a .nspire extension, drops a ransom note in every directory containing encrypted files, and notably also encrypts OneDrive-synced files in the cloud without altering their extensions. Operators reach endpoints via Remote Desktop Protocol, install legitimate remote administration tools (Chrome Remote Desktop, AnyDesk) for persistence, use Everything (voidtools), 7-Zip, and MEGAsync for discovery, staging, and exfiltration to MEGA cloud storage, and leak data on a Tor-based site if victims refuse to pay.

- **Published:** 2026-05-23T12:00:00Z
- **Last reviewed:** 2026-05-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0571
- **ID:** TL-2026-0571
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** NightSpire
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

NightSpire is an emerging ransomware family first observed in February 2025 and tracked publicly from early 2025 through 2026 by Picus Security, Huntress, SonicWall, and Broadcom. The operators run a classic double-extortion playbook: stage and exfiltrate sensitive data before encrypting endpoints, then threaten to leak the stolen files on a Tor-based leak site if victims refuse to pay. Between March and June 2025 the group hit at least 64 organizations across 33 countries, with the U.S. leading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt. Targeted verticals include healthcare, education, government, finance, manufacturing, hospitality, IT services, and logistics — a deliberately broad targeting profile consistent with opportunistic ransomware operators.

Whether NightSpire is run as a Ransomware-as-a-Service (RaaS) is contested. Halcyon reported in July 2025 that operations are kept in-house with no affiliate program ('a closed shop'), while HivePro reported two months later that NightSpire is operating under a RaaS model. Huntress notes that this divergence is consistent with significant TTP variation observed between distinct intrusions, including changes to the ransom note filename and content ('_nightspire_readme.txt' in December 2025 vs. '[nspire_msg].txt' in March 2026) and the encryptor SHA256 across samples — behavior characteristic of either an evolving in-house tool or multiple affiliates handling different intrusions.

Initial Access: In observed intrusions the threat actor reached endpoints over Remote Desktop Protocol (RDP), consistent with credential reuse, brute force, or purchased access from initial access brokers. No CVE exploitation has been publicly attributed to the operators.

Persistence: Rather than develop bespoke persistence mechanisms, operators install legitimate remote administration software. Chrome Remote Desktop was deployed on at least two compromised machines, registering a Windows service named 'Chrome Remote Desktop Service' running C:\Program Files (x86)\Google\Chrome Remote Desktop\147.0.7727.3\remoting_host.exe with --type=daemon --host-config=... arguments tied to the Google account prince1990905@gmail.com. AnyDesk was installed on a separate endpoint, registering both an 'AnyDesk Service' Windows service and an anydesk.lnk shortcut in the Startup folder for boot persistence. Huntress also observed VMware Workstation and WPS Office (Kingsoft) being staged on compromised endpoints.

Discovery and Collection: Operators ran Everything by voidtools — a freeware file-indexing tool — to enumerate sensitive files across local and mapped drives interactively via its GUI. Huntress reconstructed the lineage of file access decisions through Everything's process tree.

Staging and Exfiltration: 7-Zip was used to compress targeted folders into password-protected ZIP archives (typical syntax: 7z.exe a -tzip -p<PASSWORD> -mx5 C:\Users\<USER>\Downloads\data.zip ...). MEGAsync (C:\Users\<USER>\AppData\Local\MEGAsync\MEGAsync.exe /upload ...) then uploaded those archives to MEGA cloud storage. The threat actor's ops folder in the March 2026 intrusion was C:\Users\[REDACTED]\Downloads\.

Encryption: The NightSpire encryptor is a portable executable written in Go (enc.exe). Go's statically linked binaries enable cross-platform compilation for Windows, Linux, and macOS, and produce characteristic large binaries with identifiable strings. On execution the encryptor opens a console via conhost.exe, walks every accessible drive and path, builds a target file list, encrypts each file, and appends a .nspire extension to the original filename. A ransom note is dropped into every directory containing encrypted files. Two ransom-note filenames have been observed: _nightspire_readme.txt (December 2025) and [nspire_msg].txt (March 2026). SHA256 hashes for two encryptor samples are documented: bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355 (2 Dec 2025) and ad67031e2ca68764fe1a7d6632c02b02a299d59efb920710011a9a2ccf4399b7 (25 Mar 2026).

Cloud Impact: A defining characteristic of NightSpire is that it also encrypts OneDrive-synced files in cloud storage without changing the file extension. The ransom note explicitly calls this out: 'REMEMBER! We also locked files in OneDrive. And we did not change the extensions of files in OneDrive.' This effectively defeats common assumptions that cloud-backed files are protected against ransomware impact, since the encryption occurs on the synced local copy and propagates via the OneDrive sync engine to the cloud copy.

Detection Priorities: NightSpire intrusions are entirely living-off-the-land outside the encryptor itself. Detection coverage should center on: anomalous installation of Chrome Remote Desktop / AnyDesk on servers that normally do not run them; creation of services named 'Chrome Remote Desktop Service' or 'AnyDesk Service' outside expected change windows; anydesk.lnk appearing in user Startup folders; presence of Everything.exe, 7z.exe, and MEGAsync.exe under user-writable directories like C:\Users\...\Downloads\; mass file rename events appending .nspire; and ransom-note file creation matching _nightspire_readme.txt or [nspire_msg].txt. Network telemetry should flag uploads to mega.nz / mega.io domains and outbound to Chrome Remote Desktop relay infrastructure (remoting-pa.googleapis.com) from servers.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1070 Indicator Removal
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1135 Network Share Discovery
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1560 Archive Collected Data
- T1530 Data from Cloud Storage
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1490 Inhibit System Recovery
- T1585 Establish Accounts

## Sources

- [NightSpire Ransomware Attack Chain, Tools and Tactics (Picus, Umut Bayram)](https://www.picussecurity.com/resource/blog/nightspire-ransomware-attack-chain-tools-and-tactics)
- [Leveling Up with NightSpire Ransomware — Decoding NightSpire: Ransomware IOCs aren't set in stone (Huntress, Carvey & O'Donnell-Welch)](https://www.huntress.com/blog/nightspire-ransomware)
- [NightSpire ransomware encrypts cloud-stored OneDrive files (SonicWall)](https://www.sonicwall.com/blog/nightspire-ransomware-encrypts-onedrive-files)
- [NightSpire Ransomware (Broadcom Protection Bulletin)](https://www.broadcom.com/support/security-center/protection-bulletin/nightspire-ransomware)
- [MITRE ATT&CK — T1133 External Remote Services](https://attack.mitre.org/techniques/T1133/)
- [MITRE ATT&CK — T1486 Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/)
- [MITRE ATT&CK — T1567.002 Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002/)
- [voidtools Everything — file-indexing utility used by operators for discovery](https://www.voidtools.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0571