Threat reportRansomwareTL-2026-1448
Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour Encryption
Spirals Ransomware Targets South Asian IT Services Firm via (TL-2026-1448), also tracked as Spirals ransomware, is a high-severity ransomware operation, first published 2026-07-17. It has no confirmed attribution, affects Microsoft Internet Information Services (IIS), maps to 34 MITRE ATT&CK techniques (T1003.001, T1003.002, T1007), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 34MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1448
- Threat ID
- TL-2026-1448
- Also known as
- Spirals ransomware, Spirals extortion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- information technology, managed service providers
- Target regions
- South Asia, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Spirals Ransomware Targets South Asian IT Services Firm via
Malware and tooling: Spirals, Chisel, PSEXEC, Reverse SOCKS proxy over port 443, cloudflared, revsocks
How Spirals Ransomware Targets South Asian IT Services Firm via works
A previously unseen Rust-based ransomware family named Spirals compromised an internet-facing IIS web server at a South Asian IT services company, deploying an ASP.NET web shell for initial access, then rapidly escalated privileges, dumped SAM/LSASS credentials, moved laterally via WMI and PsExec to a dozen-plus hosts, disabled Windows Defender and 23 backup/database/virtualization services, and encrypted files with per-file AES-128 keys wrapped by an attacker-controlled ECDH P-256 key — all in under 24 hours.
In mid-June 2026, Symantec's Threat Hunter Team observed a double-extortion ransomware intrusion against an IT services company in South Asia carried out by operators using a newly identified, full-featured Rust ransomware family they named 'Spirals'. The attackers gained initial access by compromising a publicly exposed Microsoft IIS web server and uploading an ASP.NET web shell, which they used to spawn cmd.exe and powershell.exe through the IIS worker process (w3wp.exe).
Over a rapid, roughly three-hour interactive session beginning 2026-06-16 22:21 local time, the operators bypassed User Account Control, enabled Remote Desktop Protocol, created a local persistence account, enumerated users/shares/installed software, and dumped the SAM hive to a password-protected archive. Within the first ten minutes of access they staged a suite of redundant tunneling and remote-access tools directly in the IIS web production directory and the Windows Tasks folder: a generic tunneling binary (tunn.exe), a reverse SOCKS proxy (revsocks.exe), the Chisel tunneling tool renamed chrome.exe to blend in with the legitimate Google Chrome browser, the official Cloudflare Tunnel client (cloudflared-windows-amd64.exe) used to expose internal RDP externally, and a token-impersonation utility (tokens.exe). All channels rode outbound port 443 to blend with normal HTTPS traffic. Staged payloads were fetched from an attacker-controlled IP over HTTP using a .jpg file extension to evade content filtering, and were also observed hosted on what appear to be compromised third-party web servers.
Beginning at 23:33 the same night, the operators pivoted to WMI-based lateral movement targeting domain administrator accounts, dumping LSASS process memory via 'rundll32.exe comsvcs.dll MiniDump', and reaching more than a dozen additional hosts within minutes. Ransomware precursor activity was already visible by 23:07, less than 90 minutes after initial access.
On 2026-06-17 at approximately 14:12, the operators used PsExec (running as SYSTEM) to push a base64-encoded PowerShell defense-evasion payload to an extensive target list of domain controllers, file servers, application servers, virtual machines, and workstations, likely derived from prior Active Directory enumeration — one source host fired off new PsExec pushes to fresh targets every few seconds for roughly 30 minutes. The PowerShell payload disabled Windows Defender real-time monitoring and IOAV protection via MpCmdRun.exe, removed AV threat definitions, and forcibly stopped services associated with 23 backup, database, and virtualization products including Veeam, VMware, Hyper-V, SQL Server, Oracle, MySQL, PostgreSQL, Acronis, Veritas, Commvault, Exchange, Intuit, SAP, and Lotus Domino.
By 14:44 on 2026-06-17 — under 24 hours after the initial web shell upload — the Spirals ransomware payload itself, masquerading under the filename bitsadmin.exe (and also observed as vbr2116.exe), was pushed network-wide via the same PsExec mechanism. Spirals is a full-featured Rust binary supporting defense evasion, encryption, lateral movement, process termination, obfuscation, and privilege escalation. It encrypts files using per-file AES-128 keys, each wrapped with an attacker-controlled ECDH P-256 public key; files larger than 5 MB are encrypted intermittently in jittered chunks to speed up mass encryption. A ransom note, RECOVERY_SECTION.log, is dropped at the root of C:\, directing victims to a Tor negotiation portal and threatening publication of exfiltrated data within six days if no ransom is paid — a classic double-extortion model.
Symantec did not attribute the intrusion to a named, previously tracked threat actor or ransomware-as-a-service brand, but assessed that the operators' speed, tooling discipline (redundant C2 channels, living-off-the-land binary masquerading, systematic AD-driven targeting), and operational tempo indicate skilled operators capable of running broader campaigns despite only a single confirmed victim being documented to date.
MITRE ATT&CK techniques used in TL-2026-1448
Credential Access
T1003.001 LSASS Memory; T1003.002 Security Account Manager; T1556 Modify Authentication Process
Discovery
T1007 System Service Discovery; T1082 System Information Discovery; T1087.001 Local Account; T1135 Network Share Discovery
lateral-movement
T1021.001 Remote Desktop Protocol
Lateral Movement
T1021.002 SMB/Windows Admin Shares; T1021.006 Windows Remote Management; T1570 Lateral Tool Transfer
Defense Evasion
T1027.001 Binary Padding; T1036.004 Masquerade Task or Service; T1036.006 Space after Filename; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1567.002 Exfiltration to Cloud Storage
Command and Control
T1071.001 Web Protocols; T1090.002 External Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Privilege Escalation
T1078.002 Domain Accounts; T1548.002 Bypass User Account Control
Persistence
T1136.001 Local Account; T1505.004 IIS Components
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
defense-impairment
T1578 Modify Cloud Compute Infrastructure; T1685 Disable or Modify Tools
Reconnaissance
Affected products and versions in Spirals Ransomware Targets South Asian IT Services Firm via
- Microsoft — Internet Information Services (IIS)
Vulnerable versions: internet-facing IIS deployments with vulnerable/unpatched web applications enabling web shell upload - Microsoft — Windows Server
Vulnerable versions: domain-joined Windows Server hosts reachable via WMI/PsExec from a compromised web tier - Microsoft — Windows (workstation and server)
Vulnerable versions: hosts with LSASS accessible via rundll32.exe/comsvcs.dll and unrestricted SMB/WMI admin access
Remediation for Spirals Ransomware Targets South Asian IT Services Firm via
Patches
- No CVE was disclosed for this intrusion; harden IIS web application code and dependencies that allowed initial web shell upload (validate/patch the vulnerable upload or deserialization functionality in the affected web application)
- Apply latest Windows security updates to reduce UAC bypass and LOLBin abuse surface (comsvcs.dll, rundll32.exe, MpCmdRun.exe controls)
Immediate actions
- Block outbound/inbound traffic to 185.141.216.194 and the associated URLs at the perimeter firewall/proxy
- Hunt for and remove bitsadmin.exe, vbr2116.exe, chrome.exe (Tasks folder), tunn.exe, revsocks.exe, tokens.exe, and cloudflared-windows-amd64.exe in non-standard locations (web production directories, Windows\Tasks, user profile Public/Desktop/AppData\Local\Temp)
- Isolate and re-image any host with WMI-triggered process creation from an IIS server account
- Rotate all domain administrator and service account credentials; assume SAM hive and LSASS memory were fully compromised
- Audit and disable any newly created local accounts and re-enabled RDP on internet-facing or internal servers
- Preserve forensic evidence (memory, event logs, IIS logs) before remediation to support incident response and law enforcement engagement
Workarounds
- Disable or tightly restrict comsvcs.dll invocation via rundll32.exe using application control policies (AppLocker/WDAC)
- Block outbound Cloudflare Tunnel (cloudflared) and unauthorized SOCKS/tunneling binaries via EDR/network egress controls unless explicitly whitelisted
- Enforce MFA and conditional access for RDP; disable RDP by default on servers unless business-justified
Longer-term hardening
- Deploy EDR/behavioral detection with LSASS access protection (Credential Guard / PPL) on all Windows servers and workstations
- Restrict outbound HTTP/HTTPS from IIS worker processes and web server hosts to only required destinations
- Implement application allowlisting to block execution of renamed binaries (e.g., chrome.exe outside Program Files) from Tasks/Temp/web directories
- Enforce network segmentation between internet-facing web tiers and internal AD/domain-admin infrastructure
- Restrict and monitor use of PsExec, WMI, and remote admin tooling; require just-in-time privileged access for domain admin accounts
- Deploy immutable/offline backups and validate restore procedures given the attackers' explicit targeting of Veeam/Acronis/Commvault backup infrastructure
Weaknesses (CWE) in Spirals Ransomware Targets South Asian IT Services Firm via
Timeline of Spirals Ransomware Targets South Asian IT Services Firm via
- Starting at 23:33, operators use WMI to move laterally, dump LSASS memory via rundll32.exe/comsvcs.dll, and reach more than a dozen hosts including systems tied to domain administrator accounts; ransomware precursor activity is visible by 23:07.
- Operators stage tunn.exe, revsocks.exe, Chisel (renamed chrome.exe), cloudflared-windows-amd64.exe, and tokens.exe in the IIS web production directory and Windows Tasks folder, establishing redundant C2 channels over port 443, all within the first ten minutes of access.
- Within the same session, operators bypass UAC, enable RDP, create a local persistence account, dump the SAM hive to a password-protected archive, and enumerate users, shares, and installed software (22:21-23:07).
- Attackers compromise an internet-facing IIS web server at a South Asian IT services firm and upload an ASP.NET web shell, gaining code execution via the IIS worker process at approximately 22:21 local time.
- At approximately 14:44 — under 24 hours after initial access — the Spirals ransomware payload (bitsadmin.exe / vbr2116.exe) is pushed network-wide via PsExec and begins encrypting files with per-file AES-128 keys wrapped by an ECDH P-256 public key, dropping the RECOVERY_SECTION.log ransom note.
- At approximately 14:12, operators use PsExec (as SYSTEM) to push a base64-encoded PowerShell payload across domain controllers, file servers, application servers, VMs, and workstations, disabling Windows Defender and stopping services for 23 backup/database/virtualization products, over roughly 30 minutes.
- Symantec's Threat Hunter Team publishes technical analysis and IOCs for the Spirals ransomware intrusion at security.com.
- Help Net Security and other outlets report on the Spirals ransomware campaign, summarizing Symantec's findings for a broader audience.
Sources cited for Spirals Ransomware Targets South Asian IT Services Firm via
- Spirals ransomware group targets IT firm in South Asia
- Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
- New Spirals ransomware encrypts victim network in under 24 hours
- New Spirals Ransomware Launches Rapid Encryption Attack on Company Networks in 24 Hours
- New Spirals ransomware can lock down an entire network in under 24 hours
- Spirals Ransomware Hit South Asian IT Firm After IIS Server Breach
- Chisel (Malware Family) profile
Detection coverage for TL-2026-1448
As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1448 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.