# Spirals Ransomware: Rust-Based Double-Extortion Family Breaches South Asian IT Services Firm via IIS Web Shell in Under 24 Hours

> A previously undocumented Rust-based ransomware family named Spirals was deployed in a double-extortion attack against a South Asian IT services company. The actor compromised an internet-facing IIS web server via an ASP.NET web shell on 2026-06-16 and achieved full network-wide encryption by 2026-06-17 — a breach-to-ransom timeline of roughly 16 hours.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1410
- **ID:** TL-2026-1410
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-06-16 at 22:21 local time, an unattributed threat actor gained initial access to a South Asian IT services company by deploying an ASP.NET web shell on an internet-facing Microsoft IIS web server. Within three hours the actor had enabled RDP, performed a UAC bypass to escalate privileges, created new local accounts for persistence, dumped the SAM hive to harvest credentials, and enumerated network shares and installed software to map the environment.

At 23:33 the same night, the actor pivoted to lateral movement using WMI with compromised domain administrator credentials, reaching more than a dozen additional machines. The actor established multiple redundant network tunnels for resilient C2 and remote access, deploying tunn.exe (a generic tunneling utility), revsocks.exe (a reverse SOCKS proxy), a renamed Chisel binary masquerading as chrome.exe (encrypted tunneling over HTTP), and the legitimate cloudflared-windows-amd64.exe binary (Cloudflare Tunnel client) to abuse trusted cloud infrastructure for covert C2 egress. A token-impersonation tool, tokens.exe, was also staged for privilege manipulation.

On 2026-06-17 at 14:44, the actor used PsExec to push a base64-encoded PowerShell payload across the environment that disabled Windows Defender via MpCmdRun.exe (-RemoveDefinitions -All -DisableRealtimeMonitoring), then forcibly terminated 23 backup, virtualization, and database services — including Microsoft Exchange, Hyper-V, VMware, Veeam, SQL Server, Oracle, MySQL, and PostgreSQL — to eliminate recovery options and unlock database files for encryption.

The Spirals ransomware payload, a Rust-compiled binary, was distributed at scale via SYSVOL and domain controller shares to reach the broadest possible set of endpoints, and dropped locally under the masquerading filenames bitsadmin.exe and vbr2116.exe (the latter in the Temp directory, itself a further piece of Veeam-Backup-and-Replication-themed camouflage). The malware encrypts files using per-file AES-128 keys, each of which is wrapped with an attacker-controlled ECDH P-256 public key so that only the attacker's corresponding private key can recover the symmetric keys. Files larger than 5 MB are encrypted in jittered chunks to increase throughput and complicate forensic timeline reconstruction. A ransom note was dropped as C:\RECOVERY_SECTION.log, and the actor pursued a double-extortion model, threatening to publish exfiltrated data within six days if the ransom was not paid.

The entire operation — from initial web shell access to full-network ransomware detonation — spanned roughly 16 hours, indicating a highly practiced, largely automated or heavily scripted playbook. No CVE was cited for the initial IIS/ASP.NET compromise, suggesting either a misconfiguration, weak/stolen credentials, or an unpatched/undisclosed application-layer vulnerability in a customer-built or third-party ASP.NET application rather than a core IIS flaw. The threat actor remains unattributed as of reporting; the operational discipline and tooling maturity suggest an experienced ransomware affiliate or emerging RaaS operation likely to conduct further campaigns.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1136 Create Account
- T1219 Remote Access Tools
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1059 Command and Scripting Interpreter
- T1003 OS Credential Dumping
- T1135 Network Share Discovery
- T1518 Software Discovery
- T1018 Remote System Discovery
- T1047 Windows Management Instrumentation
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1080 Taint Shared Content
- T1090 Proxy
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1485 Data Destruction

## Sources

- [Ransomware: Spirals Extortion Attack](https://www.security.com/threat-intelligence/ransomware-spirals-extortion)
- [Ransomware Trends 2026: What's Changing](https://www.huntress.com/ransomware-guide/ransomware-trends)
- [Ransomware in Q1 2026: Why Double Extortion Is Now a Compliance Problem, Not Just a Security One](https://www.kiteworks.com/cybersecurity-risk-management/ransomware-double-extortion-compliance/)
- [Ransomware Surged 49%: 8,159 Victims](https://shattered.io/ransomware-groups-surge-2026/)
- [Double extortion ransomware: detect it before data is lost](https://www.vectra.ai/topics/double-extortion)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1410