New "Spirals" Ransomware Encrypts Victim Network in Under 24 Hours via Exposed IIS Server
New "Spirals" Ransomware Encrypts Victim Network in Under 24 (TL-2026-1412), also tracked as Spirals, is a high-severity ransomware operation, first published 2026-07-16. It has no confirmed attribution, affects Microsoft Internet Information Services (IIS), maps to 19 MITRE ATT&CK techniques (T1003, T1016, T1021), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-1412
- Threat ID
- TL-2026-1412
- Also known as
- Spirals
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- information technology, managed service providers
- Target regions
- South Asia
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in New "Spirals" Ransomware Encrypts Victim Network in Under 24
Malware and tooling: Spirals, Chisel, Chisel/revsocks/Cloudflare Tunnel multi-tool tunneling stack, PSEXEC, cloudflared, revsocks
A previously undocumented Rust-based ransomware family named Spirals compromised a South Asian IT services firm through a publicly exposed IIS server in June 2026, moving from initial access to full network encryption in under 24 hours. The actors used a web shell, UAC bypass, SAM/LSASS credential theft, WMI-based lateral movement, disabled 23 backup/database/virtualization services, and deployed the payload via PsExec running as SYSTEM.
How New "Spirals" Ransomware Encrypts Victim Network in Under 24 works
In June 2026, Symantec's Threat Hunter Team identified a new ransomware family dubbed Spirals used in an attack against an IT services firm in South Asia. The intrusion began with compromise of a publicly exposed Internet Information Services (IIS) web server, onto which the attackers uploaded an ASP.NET web shell to obtain initial code execution. From this foothold the attackers performed local privilege escalation via a User Account Control (UAC) bypass, then harvested credentials by dumping the SAM registry hive and reading LSASS process memory, giving them access to privileged domain and local accounts.
The actors then pivoted laterally using Windows Management Instrumentation (WMI) to reach more than a dozen additional systems across the network. To maintain access and support command-and-control, they enabled Remote Desktop Protocol, created a new local account, and deployed multiple tunneling utilities — revsocks, Chisel, and Cloudflare Tunnel (cloudflared) — to proxy traffic out over HTTPS and evade network egress controls.
Before detonating the ransomware, the operators methodically disabled 23 backup, database, and virtualization-related services and products (including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL components) to prevent recovery and maximize damage to virtualized and database workloads. The ransomware payload itself — written in Rust — was renamed bitsadmin.exe to masquerade as the legitimate Windows Background Intelligent Transfer Service admin utility and was pushed to victim hosts and executed via PsExec running with SYSTEM privileges.
Spirals encrypts files using AES-128 session keys individually protected by an attacker-controlled ECDH P-256 public key, a scheme that prevents decryption without the attacker's private key. To accelerate encryption across the estate, Spirals uses intermittent (partial) encryption for files larger than 5MB, encrypting only portions of large files rather than their full contents — a technique increasingly common among modern ransomware families to minimize dwell time and maximize speed between compromise and impact. The entire operation, from the initial IIS compromise to full-network encryption, took under 24 hours.
After encryption, a ransom note named RECOVERY_SECTION.log was dropped to the root of the C:\ drive, threatening public exposure of stolen data within six days if the ransom was not paid, indicating the group follows a double-extortion model. As of the report, only a single victim had been publicly documented and no attribution to a known ransomware group or affiliate has been established; Spirals is assessed as either a genuinely new, independently developed strain or a rebrand/variant not yet linked to prior tooling.
MITRE ATT&CK techniques used in TL-2026-1412
Credential Access
Discovery
T1016 System Network Configuration Discovery
Lateral Movement
Defense Evasion
execution
T1047 Windows Management Instrumentation
Execution
T1059 Command and Scripting Interpreter; T1569 System Services
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Persistence
T1136 Create Account; T1505 Server Software Component
Initial Access
T1190 Exploit Public-Facing Application
command-and-control
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Exfiltration
T1567 Exfiltration Over Web Service
defense-impairment
Affected products and versions in New "Spirals" Ransomware Encrypts Victim Network in Under 24
- Microsoft — Internet Information Services (IIS)
Vulnerable versions: publicly exposed/misconfigured IIS deployments - Various — Backup, database, and virtualization software (Veeam, VMware, Hyper-V, Microsoft SQL Server, Oracle Database, PostgreSQL)
Vulnerable versions: deployments reachable/disable-able by an administrator-level attacker
Remediation for New "Spirals" Ransomware Encrypts Victim Network in Under 24
Patches
- No CVE was disclosed for this campaign; harden and patch the internet-facing IIS server and underlying OS to current vendor baselines
Immediate actions
- Take internet-facing IIS servers offline or restrict access until patched and hardened; audit for unauthorized ASP.NET web shells and unfamiliar .aspx files in wwwroot
- Disable or tightly restrict outbound access for tunneling tools (Chisel, revsocks, cloudflared) at the network egress/firewall layer, and alert on their process execution
- Restrict and monitor use of PsExec and other remote-execution/admin tools; require MFA and just-in-time elevation for administrative accounts
- Enable LSASS protection (Credential Guard / RunAsPPL) and restrict SAM registry hive access to prevent offline credential dumping
- Monitor for mass/rapid service-stop events targeting backup (Veeam), virtualization (VMware, Hyper-V), and database (SQL Server, Oracle, PostgreSQL) services
- Isolate and preserve immutable, offline/air-gapped backups so recovery does not depend on backup infrastructure reachable from the production network
Workarounds
- Where the exposed IIS service cannot be immediately patched, place it behind a reverse proxy/WAF and restrict administrative interfaces to trusted IP ranges
Longer-term hardening
- Deploy EDR with behavioral detection tuned for intermittent/partial file encryption patterns rather than signature-based detection alone
- Implement network segmentation to limit WMI-based lateral movement between IIS/DMZ hosts and internal server/database tiers
- Adopt a zero-trust model for public-facing web servers, including regular patching, web application firewalls, and reduced attack surface (disable unneeded IIS modules/features)
- Establish egress filtering and DNS monitoring to detect unauthorized tunneling protocols (SSH-over-HTTPS, Cloudflare Tunnel abuse)
Weaknesses (CWE) in New "Spirals" Ransomware Encrypts Victim Network in Under 24
CWE-668, CWE-522, CWE-306
Timeline of New "Spirals" Ransomware Encrypts Victim Network in Under 24
- A ransom note named RECOVERY_SECTION.log is placed on the C:\ drive of encrypted hosts, threatening public data exposure within six days.
- Full network encryption is achieved in under 24 hours from initial access, using AES-128 keys wrapped with an attacker-controlled ECDH P-256 public key and intermittent encryption for files over 5MB.
- The Spirals ransomware payload, disguised as bitsadmin.exe, is pushed to victim systems and executed via PsExec running as SYSTEM.
- Attackers systematically disable 23 backup, database, and virtualization products/services (including Veeam, VMware, Hyper-V, SQL Server, Oracle, PostgreSQL) to inhibit recovery.
- Attackers enable RDP, create a new local account, and deploy revsocks, Chisel, and Cloudflare Tunnel for covert C2 and access persistence.
- Using harvested credentials, attackers move laterally via WMI to compromise more than a dozen additional systems.
- Attackers dump the SAM registry hive and read LSASS process memory to harvest credentials for lateral movement.
- Attackers perform a UAC bypass to escalate privileges on the compromised host.
- Attackers compromise a publicly exposed IIS server belonging to a South Asian IT services firm and upload an ASP.NET web shell for initial code execution.
- Symantec's Threat Hunter Team publishes technical analysis of the Spirals ransomware campaign; BleepingComputer reports on the findings.
Sources cited for New "Spirals" Ransomware Encrypts Victim Network in Under 24
Threats related to New "Spirals" Ransomware Encrypts Victim Network in Under 24
- Spirals Ransomware — New Rust-Based Family Breaches Internet-Facing IIS Server, Encrypts Entire Domain Within 24 Hours
- Spirals Ransomware: Rust-Based Double-Extortion Family Breaches South Asian IT Services Firm via IIS Web Shell in Under 24 Hours
- Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour Encryption
- Krybit Ransomware — Babuk-Derived RaaS Operation Emerges with Double Extortion
Detection coverage for TL-2026-1412
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1412 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.