Spirals Ransomware: Rust-Based Double-Extortion Family Breaches South Asian IT Services Firm via IIS Web Shell in Under 24 Hours
Spirals Ransomware (TL-2026-1410), also tracked as Spirals, is a high-severity ransomware operation, first published 2026-07-16. It has no confirmed attribution, affects Microsoft Internet Information Services (IIS), maps to 28 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1410
- Threat ID
- TL-2026-1410
- Also known as
- Spirals
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- information technology, managed service providers
- Target regions
- South Asia
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Spirals Ransomware
Malware and tooling: Spirals, Chisel, CloudFlare Tunnel, PSEXEC, revsocks
A previously undocumented Rust-based ransomware family named Spirals was deployed in a double-extortion attack against a South Asian IT services company. The actor compromised an internet-facing IIS web server via an ASP.NET web shell on 2026-06-16 and achieved full network-wide encryption by 2026-06-17 — a breach-to-ransom timeline of roughly 16 hours.
How Spirals Ransomware works
On 2026-06-16 at 22:21 local time, an unattributed threat actor gained initial access to a South Asian IT services company by deploying an ASP.NET web shell on an internet-facing Microsoft IIS web server. Within three hours the actor had enabled RDP, performed a UAC bypass to escalate privileges, created new local accounts for persistence, dumped the SAM hive to harvest credentials, and enumerated network shares and installed software to map the environment.
At 23:33 the same night, the actor pivoted to lateral movement using WMI with compromised domain administrator credentials, reaching more than a dozen additional machines. The actor established multiple redundant network tunnels for resilient C2 and remote access, deploying tunn.exe (a generic tunneling utility), revsocks.exe (a reverse SOCKS proxy), a renamed Chisel binary masquerading as chrome.exe (encrypted tunneling over HTTP), and the legitimate cloudflared-windows-amd64.exe binary (Cloudflare Tunnel client) to abuse trusted cloud infrastructure for covert C2 egress. A token-impersonation tool, tokens.exe, was also staged for privilege manipulation.
On 2026-06-17 at 14:44, the actor used PsExec to push a base64-encoded PowerShell payload across the environment that disabled Windows Defender via MpCmdRun.exe (-RemoveDefinitions -All -DisableRealtimeMonitoring), then forcibly terminated 23 backup, virtualization, and database services — including Microsoft Exchange, Hyper-V, VMware, Veeam, SQL Server, Oracle, MySQL, and PostgreSQL — to eliminate recovery options and unlock database files for encryption.
The Spirals ransomware payload, a Rust-compiled binary, was distributed at scale via SYSVOL and domain controller shares to reach the broadest possible set of endpoints, and dropped locally under the masquerading filenames bitsadmin.exe and vbr2116.exe (the latter in the Temp directory, itself a further piece of Veeam-Backup-and-Replication-themed camouflage). The malware encrypts files using per-file AES-128 keys, each of which is wrapped with an attacker-controlled ECDH P-256 public key so that only the attacker's corresponding private key can recover the symmetric keys. Files larger than 5 MB are encrypted in jittered chunks to increase throughput and complicate forensic timeline reconstruction. A ransom note was dropped as C:\RECOVERY_SECTION.log, and the actor pursued a double-extortion model, threatening to publish exfiltrated data within six days if the ransom was not paid.
The entire operation — from initial web shell access to full-network ransomware detonation — spanned roughly 16 hours, indicating a highly practiced, largely automated or heavily scripted playbook. No CVE was cited for the initial IIS/ASP.NET compromise, suggesting either a misconfiguration, weak/stolen credentials, or an unpatched/undisclosed application-layer vulnerability in a customer-built or third-party ASP.NET application rather than a core IIS flaw. The threat actor remains unattributed as of reporting; the operational discipline and tooling maturity suggest an experienced ransomware affiliate or emerging RaaS operation likely to conduct further campaigns.
MITRE ATT&CK techniques used in TL-2026-1410
Credential Access
Discovery
T1018 Remote System Discovery; T1135 Network Share Discovery; T1518 Software Discovery
Lateral Movement
T1021 Remote Services; T1080 Taint Shared Content; T1550 Use Alternate Authentication Material
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Privilege Escalation
T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism
Persistence
T1136 Create Account; T1505 Server Software Component
Initial Access
T1190 Exploit Public-Facing Application
command-and-control
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
privilege-escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
Affected products and versions in Spirals Ransomware
- Microsoft — Internet Information Services (IIS)
Vulnerable versions: internet-facing IIS deployments hosting ASP.NET applications - Microsoft — Windows Server / Active Directory
Vulnerable versions: domain environments reachable via WMI/PsExec from a compromised web-tier host - Microsoft — Exchange Server
Vulnerable versions: deployments co-located on breached domain - Veeam — Veeam Backup & Replication
Vulnerable versions: targeted for service termination prior to encryption - VMware — vSphere / Hyper-V virtualization hosts
Vulnerable versions: targeted for service termination prior to encryption - Microsoft — SQL Server
Vulnerable versions: targeted for service termination prior to encryption - Oracle — Oracle Database
Vulnerable versions: targeted for service termination prior to encryption - Oracle — MySQL
Vulnerable versions: targeted for service termination prior to encryption - PostgreSQL Global Development Group — PostgreSQL
Vulnerable versions: targeted for service termination prior to encryption
Remediation for Spirals Ransomware
Immediate actions
- Isolate and forensically image the compromised internet-facing IIS server; take it offline pending investigation
- Block outbound connections to 185.141.216.194 and DNS resolution/traffic to computer.kplus.com and beta.padmin.com at perimeter firewalls and DNS resolvers
- Hunt for and quarantine files named tunn.exe, revsocks.exe, chrome.exe (non-standard path), cloudflared-windows-amd64.exe, tokens.exe, bitsadmin.exe (outside System32), and vbr2116.exe
- Search SYSVOL and domain controller shares for unauthorized executables and remove immediately
- Force a domain-wide credential reset for all domain administrator and service accounts, prioritizing any accounts used the night of the intrusion
- Audit and disable unnecessary outbound access to cloudflared/Cloudflare Tunnel, ngrok, and similar tunneling services unless explicitly required by IT operations
- Verify Windows Defender / EDR real-time protection status fleet-wide and re-enable/re-deploy on any host where MpCmdRun.exe -RemoveDefinitions or -DisableRealtimeMonitoring was executed
Workarounds
- Restrict direct internet exposure of IIS management interfaces and unused ASP.NET application endpoints until a full security review is completed
- Enforce MFA on all remote access and RDP is disabled or gated behind a jump host / VPN with conditional access
Longer-term hardening
- Deploy EDR with behavioral detection and tamper protection across all servers and workstations, including domain controllers
- Implement network segmentation isolating internet-facing web servers (DMZ) from internal domain infrastructure and backup/database services
- Restrict and monitor use of WMI and PsExec for lateral movement; require just-in-time privileged access for admin tooling
- Harden backup infrastructure with immutable/offline (air-gapped) backups and separate credentials from the production Active Directory domain
- Deploy web application firewalls and regular web shell detection scanning on all internet-facing IIS/ASP.NET applications
- Implement application allowlisting to prevent execution of unauthorized tunneling and proxy binaries
Weaknesses (CWE) in Spirals Ransomware
CWE-434, CWE-276, CWE-269, CWE-522
Timeline of Spirals Ransomware
- At 23:33, the actor begins lateral movement via WMI using compromised domain administrator credentials, reaching more than a dozen additional machines.
- Within three hours of initial access, the actor enables RDP, performs a UAC bypass, creates local accounts, dumps the SAM hive, and enumerates network shares and installed software.
- Threat actor gains initial access at 22:21 local time by deploying an ASP.NET web shell on an internet-facing IIS web server.
- Actor threatens to publish exfiltrated data within six days if ransom demands are not met.
- Ransom note written to C:\RECOVERY_SECTION.log on encrypted hosts, completing the breach-to-encryption cycle in roughly 16 hours.
- Spirals ransomware payload is distributed via SYSVOL and domain controller shares and executed under masquerading filenames bitsadmin.exe and vbr2116.exe, encrypting files across the network.
- The actor forcibly terminates 23 backup, virtualization, and database services (Exchange, Hyper-V, VMware, Veeam, SQL Server, Oracle, MySQL, PostgreSQL) network-wide to disable recovery and unlock files for encryption.
- At 14:44, the actor uses PsExec to push a base64-encoded PowerShell payload that disables Windows Defender real-time monitoring and definitions via MpCmdRun.exe.
- Security.com Threat Intelligence publishes technical analysis of the Spirals ransomware attack, disclosing tooling, IOCs, and TTPs.
Sources cited for Spirals Ransomware
Threats related to Spirals Ransomware
- Spirals Ransomware — New Rust-Based Family Breaches Internet-Facing IIS Server, Encrypts Entire Domain Within 24 Hours
- New "Spirals" Ransomware Encrypts Victim Network in Under 24 Hours via Exposed IIS Server
- Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour Encryption
- Ransom Cartel ransomware creator Maksim Silnikau sentenced to 16 years in federal prison
- Q1 2026 Ransomware Landscape: Qilin Dominance, LockBit 5.0 Comeback, and FortiGate (CVE-2024-55591) / Oracle EBS (CVE-2025-61882) Mass Exploitation
- The Gentlemen RaaS (Storm-2697) — Multi-Platform Ransomware-as-a-Service with BYOVD Defense Evasion and Self-Propagating Go Encryptor
Detection coverage for TL-2026-1410
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1410 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.