# New "Spirals" Ransomware Encrypts Victim Network in Under 24 Hours via Exposed IIS Server

> A previously undocumented Rust-based ransomware family named Spirals compromised a South Asian IT services firm through a publicly exposed IIS server in June 2026, moving from initial access to full network encryption in under 24 hours. The actors used a web shell, UAC bypass, SAM/LSASS credential theft, WMI-based lateral movement, disabled 23 backup/database/virtualization services, and deployed the payload via PsExec running as SYSTEM.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1412
- **ID:** TL-2026-1412
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In June 2026, Symantec's Threat Hunter Team identified a new ransomware family dubbed Spirals used in an attack against an IT services firm in South Asia. The intrusion began with compromise of a publicly exposed Internet Information Services (IIS) web server, onto which the attackers uploaded an ASP.NET web shell to obtain initial code execution. From this foothold the attackers performed local privilege escalation via a User Account Control (UAC) bypass, then harvested credentials by dumping the SAM registry hive and reading LSASS process memory, giving them access to privileged domain and local accounts.

The actors then pivoted laterally using Windows Management Instrumentation (WMI) to reach more than a dozen additional systems across the network. To maintain access and support command-and-control, they enabled Remote Desktop Protocol, created a new local account, and deployed multiple tunneling utilities — revsocks, Chisel, and Cloudflare Tunnel (cloudflared) — to proxy traffic out over HTTPS and evade network egress controls.

Before detonating the ransomware, the operators methodically disabled 23 backup, database, and virtualization-related services and products (including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL components) to prevent recovery and maximize damage to virtualized and database workloads. The ransomware payload itself — written in Rust — was renamed bitsadmin.exe to masquerade as the legitimate Windows Background Intelligent Transfer Service admin utility and was pushed to victim hosts and executed via PsExec running with SYSTEM privileges.

Spirals encrypts files using AES-128 session keys individually protected by an attacker-controlled ECDH P-256 public key, a scheme that prevents decryption without the attacker's private key. To accelerate encryption across the estate, Spirals uses intermittent (partial) encryption for files larger than 5MB, encrypting only portions of large files rather than their full contents — a technique increasingly common among modern ransomware families to minimize dwell time and maximize speed between compromise and impact. The entire operation, from the initial IIS compromise to full-network encryption, took under 24 hours.

After encryption, a ransom note named RECOVERY_SECTION.log was dropped to the root of the C:\ drive, threatening public exposure of stolen data within six days if the ransom was not paid, indicating the group follows a double-extortion model. As of the report, only a single victim had been publicly documented and no attribution to a known ransomware group or affiliate has been established; Spirals is assessed as either a genuinely new, independently developed strain or a rebrand/variant not yet linked to prior tooling.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1136 Create Account
- T1219 Remote Access Tools
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1016 System Network Configuration Discovery
- T1047 Windows Management Instrumentation
- T1021 Remote Services
- T1090 Proxy
- T1572 Protocol Tunneling
- T1569 System Services
- T1059 Command and Scripting Interpreter
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1567 Exfiltration Over Web Service

## Sources

- [New Spirals ransomware encrypts victim network in under 24 hours](https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/)
- [PsExec, Software S0029](https://attack.mitre.org/software/S0029/)
- [Chisel (Malware Family) - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel)
- [Threat Actor Abuses Cloudflare Tunnels to Deliver RATs](https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats)
- [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [Server Software Component: Web Shell, T1505.003](https://attack.mitre.org/techniques/T1505/003/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1412