# Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour Encryption

> A previously unseen Rust-based ransomware family named Spirals compromised an internet-facing IIS web server at a South Asian IT services company, deploying an ASP.NET web shell for initial access, then rapidly escalated privileges, dumped SAM/LSASS credentials, moved laterally via WMI and PsExec to a dozen-plus hosts, disabled Windows Defender and 23 backup/database/virtualization services, and encrypted files with per-file AES-128 keys wrapped by an attacker-controlled ECDH P-256 key — all in under 24 hours.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1448
- **ID:** TL-2026-1448
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In mid-June 2026, Symantec's Threat Hunter Team observed a double-extortion ransomware intrusion against an IT services company in South Asia carried out by operators using a newly identified, full-featured Rust ransomware family they named 'Spirals'. The attackers gained initial access by compromising a publicly exposed Microsoft IIS web server and uploading an ASP.NET web shell, which they used to spawn cmd.exe and powershell.exe through the IIS worker process (w3wp.exe).

Over a rapid, roughly three-hour interactive session beginning 2026-06-16 22:21 local time, the operators bypassed User Account Control, enabled Remote Desktop Protocol, created a local persistence account, enumerated users/shares/installed software, and dumped the SAM hive to a password-protected archive. Within the first ten minutes of access they staged a suite of redundant tunneling and remote-access tools directly in the IIS web production directory and the Windows Tasks folder: a generic tunneling binary (tunn.exe), a reverse SOCKS proxy (revsocks.exe), the Chisel tunneling tool renamed chrome.exe to blend in with the legitimate Google Chrome browser, the official Cloudflare Tunnel client (cloudflared-windows-amd64.exe) used to expose internal RDP externally, and a token-impersonation utility (tokens.exe). All channels rode outbound port 443 to blend with normal HTTPS traffic. Staged payloads were fetched from an attacker-controlled IP over HTTP using a .jpg file extension to evade content filtering, and were also observed hosted on what appear to be compromised third-party web servers.

Beginning at 23:33 the same night, the operators pivoted to WMI-based lateral movement targeting domain administrator accounts, dumping LSASS process memory via 'rundll32.exe comsvcs.dll MiniDump', and reaching more than a dozen additional hosts within minutes. Ransomware precursor activity was already visible by 23:07, less than 90 minutes after initial access.

On 2026-06-17 at approximately 14:12, the operators used PsExec (running as SYSTEM) to push a base64-encoded PowerShell defense-evasion payload to an extensive target list of domain controllers, file servers, application servers, virtual machines, and workstations, likely derived from prior Active Directory enumeration — one source host fired off new PsExec pushes to fresh targets every few seconds for roughly 30 minutes. The PowerShell payload disabled Windows Defender real-time monitoring and IOAV protection via MpCmdRun.exe, removed AV threat definitions, and forcibly stopped services associated with 23 backup, database, and virtualization products including Veeam, VMware, Hyper-V, SQL Server, Oracle, MySQL, PostgreSQL, Acronis, Veritas, Commvault, Exchange, Intuit, SAP, and Lotus Domino.

By 14:44 on 2026-06-17 — under 24 hours after the initial web shell upload — the Spirals ransomware payload itself, masquerading under the filename bitsadmin.exe (and also observed as vbr2116.exe), was pushed network-wide via the same PsExec mechanism. Spirals is a full-featured Rust binary supporting defense evasion, encryption, lateral movement, process termination, obfuscation, and privilege escalation. It encrypts files using per-file AES-128 keys, each wrapped with an attacker-controlled ECDH P-256 public key; files larger than 5 MB are encrypted intermittently in jittered chunks to speed up mass encryption. A ransom note, RECOVERY_SECTION.log, is dropped at the root of C:\, directing victims to a Tor negotiation portal and threatening publication of exfiltrated data within six days if no ransom is paid — a classic double-extortion model.

Symantec did not attribute the intrusion to a named, previously tracked threat actor or ransomware-as-a-service brand, but assessed that the operators' speed, tooling discipline (redundant C2 channels, living-off-the-land binary masquerading, systematic AD-driven targeting), and operational tempo indicate skilled operators capable of running broader campaigns despite only a single confirmed victim being documented to date.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1505.004 IIS Components
- T1136.001 Local Account
- T1021.001 Remote Desktop Protocol
- T1548.002 Bypass User Account Control
- T1078.002 Domain Accounts
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1027.001 Binary Padding
- T1140 Deobfuscate/Decode Files or Information
- T1036.004 Masquerade Task or Service
- T1036.006 Space after Filename
- T1578 Modify Cloud Compute Infrastructure
- T1003.002 Security Account Manager
- T1003.001 LSASS Memory
- T1556 Modify Authentication Process
- T1087.001 Local Account
- T1135 Network Share Discovery
- T1007 System Service Discovery
- T1082 System Information Discovery
- T1021.002 SMB/Windows Admin Shares
- T1021.006 Windows Remote Management
- T1570 Lateral Tool Transfer
- T1090.002 External Proxy
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1490 Inhibit System Recovery

## Sources

- [Spirals ransomware group targets IT firm in South Asia](https://www.helpnetsecurity.com/2026/07/17/spirals-ransomware-south-asia/)
- [Spirals: New Stealthy Ransomware Deployed Against Asian IT Company](https://www.security.com/threat-intelligence/ransomware-spirals-extortion)
- [New Spirals ransomware encrypts victim network in under 24 hours](https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/)
- [New Spirals Ransomware Launches Rapid Encryption Attack on Company Networks in 24 Hours](https://www.news4hackers.com/new-spirals-ransomware-launches-rapid-encryption-attack-on-company-networks-in-24-hours/)
- [New Spirals ransomware can lock down an entire network in under 24 hours](https://www.pcquest.com/security-products/new-spirals-ransomware-can-lock-down-an-entire-network-in-under-24-hours-12170579)
- [Spirals Ransomware Hit South Asian IT Firm After IIS Server Breach](https://www.mallory.ai/stories/019f6a9e-79f5-7c1f-96df-0b36ce7e4956)
- [Chisel (Malware Family) profile](https://malpedia.caad.fkie.fraunhofer.de/details/win.chisel)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1448