Spirals Ransomware — New Rust-Based Family Breaches Internet-Facing IIS Server, Encrypts Entire Domain Within 24 Hours

Spirals Ransomware (TL-2026-1481), also tracked as Spirals Ransomware, is a critical-severity ransomware operation, first published 2026-07-18. It has no confirmed attribution, affects Microsoft Internet Information Services (IIS), maps to 28 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-1481

Threat ID
TL-2026-1481
Also known as
Spirals Ransomware
Severity
CRITICAL
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-18
Last reviewed
2026-07-18
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
information-technology-services
Target regions
South Asia
Detection rules
9
Indicators of compromise
30

Malware and tooling in Spirals Ransomware

Malware and tooling: Spirals, Chisel, CloudFlare Tunnel, PSEXEC, revsocks

A previously unseen Rust-based ransomware family named Spirals compromised an internet-facing IIS web server at an IT services company in South Asia on June 16, 2026 via an ASP.NET web shell, then used Chisel, Cloudflared, and revsocks tunneling tools plus PsExec-based mass deployment to achieve full domain-wide encryption within 24 hours. The malware pairs per-file AES-128 encryption with ECDH P-256 key wrapping and intermittent encryption of large files, disabled Windows Defender and 23 backup/database/virtualization services, and threatens a six-day public data leak via a Tor negotiation portal.

How Spirals Ransomware works

On June 16, 2026 at 22:21 local time, an unidentified threat actor compromised an internet-facing Microsoft IIS web server belonging to an IT services company in South Asia by uploading an ASP.NET web shell, granting remote command execution through the IIS worker process (w3wp.exe). Within minutes the actor staged multiple tunneling and reverse-proxy tools for redundant, encrypted command-and-control channels: a Chisel binary renamed to chrome.exe, a Cloudflare Tunnel client (cloudflared-windows-amd64.exe) providing outbound HTTPS-based C2, a generic tunneling utility (tunn.exe), and a reverse-SOCKS proxy (revsocks.exe) bound to external port 443. A token-impersonation tool (tokens.exe) was used for local privilege escalation alongside a UAC bypass, and the actor enabled RDP and created a local account for persistent access.

At 23:07 the actor began disabling Windows Defender via MpCmdRun.exe (-RemoveDefinitions -All -DisableRealtimeMonitoring $true -DisableIOAVProtection $true) and downloaded additional tooling, staging some payloads with a .jpg extension to disguise their content during transfer. Credential harvesting followed: the SAM registry hive was dumped to a password-protected archive, and LSASS process memory was dumped on multiple hosts using rundll32.exe in combination with comsvcs.dll (the MiniDump export technique). These credentials, combined with compromised domain-administrator accounts, enabled WMI-based lateral movement beginning at 23:33 against more than a dozen machines within minutes.

On June 17 at 14:12 the actor pivoted to mass deployment using PsExec run as SYSTEM (psexec.exe -accepteula -d -s \\<target> powershell -nop -w 1 -enc <base64 payload>), placing the ransomware binary — deployed under decoy filenames bitsadmin.exe and vbr2116.exe to masquerade as a legitimate Windows utility — into the SYSVOL domain scripts directory (sysvol_dfsr\domain\scripts) and a domain-controller network share for enterprise-wide propagation. By 14:44 the deployment cadence accelerated to more than one new target every few seconds, encrypting machines across the environment during a roughly 30-minute mass-push window. Before detonation the payload forcibly stopped 23 backup, database, and virtualization services — including Veeam, VMware, Hyper-V, Acronis, Veritas, Commvault, SQL Server, Oracle, MySQL, PostgreSQL, Exchange, Intuit, SAP, and Lotus Domino — to maximize both encryption impact and recovery difficulty.

The ransomware itself is a full-featured Rust binary implementing defense evasion, encryption, lateral movement, process termination, obfuscation, and privilege-escalation capability. Each file is encrypted with a unique per-file AES-128 key; those keys are wrapped with an attacker-controlled ECDH P-256 public key so only the attacker's matching private key can recover them. Files larger than 5MB are encrypted intermittently in jittered chunks rather than in full, a common ransomware speed optimization that also complicates some entropy-based detection heuristics. A ransom note (C:\RECOVERY_SECTION.log) was dropped instructing the victim to negotiate via a Tor hidden-service portal that explicitly names the operation "Spirals," and threatens publication of exfiltrated data within six days of non-payment — a classic double-extortion model. The overall operation, from initial web-shell access to full domain encryption, took under 24 hours, with the actor's hands-on-keyboard activity spanning roughly three hours of interactive reconnaissance, Active Directory enumeration, and target-list compilation prior to the automated mass-deployment phase. No attribution to a known ransomware group or affiliate program has been established as of this reporting; "Spirals" is treated as a newly identified, previously unseen ransomware family/brand.

MITRE ATT&CK techniques used in TL-2026-1481

Credential Access

T1003 OS Credential Dumping; T1552 Unsecured Credentials

Discovery

T1018 Remote System Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery

Lateral Movement

T1021 Remote Services; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal

execution

T1047 Windows Management Instrumentation

Execution

T1059 Command and Scripting Interpreter; T1569 System Services

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Privilege Escalation

T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

Persistence

T1136 Create Account; T1505 Server Software Component

Initial Access

T1190 Exploit Public-Facing Application

command-and-control

T1219 Remote Access Tools

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery

Exfiltration

T1567 Exfiltration Over Web Service

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Spirals Ransomware

  • Microsoft — Internet Information Services (IIS)
    Vulnerable versions: internet-facing IIS deployments with writable/exploitable web application upload paths
  • Microsoft — Windows Server / Active Directory domain environments
    Vulnerable versions: Windows Server domain environments using PsExec/WMI without strict lateral-movement controls

Remediation for Spirals Ransomware

Immediate actions

  • Audit all internet-facing IIS servers for unauthorized ASP.NET files/web shells (unexpected .aspx files, recently modified web.config)
  • Block outbound connections to 185.141.216.194 and any traffic to hxxp://185.141.216.194/cd.jpg and hxxp://185.141.216.194/cd.zip
  • Hunt for renamed binaries impersonating Windows utilities: chrome.exe outside Program Files, bitsadmin.exe outside System32, vbr2116.exe in AppData\Local\Temp
  • Alert on and investigate any MpCmdRun.exe invocation with -RemoveDefinitions -All -DisableRealtimeMonitoring flags
  • Alert on rundll32.exe spawning with comsvcs.dll and MiniDump arguments targeting lsass.exe
  • Hunt for PsExec execution launching base64-encoded PowerShell (-enc) across many hosts in a short window
  • Isolate and rotate credentials for any domain administrator account used in the WMI/PsExec lateral movement window
  • Verify backup infrastructure (Veeam, Commvault, Acronis, Veritas) integrity and immutability, and check for premature termination of backup agent services

Workarounds

  • Restrict outbound HTTPS from server subnets to prevent Cloudflare Tunnel / reverse-SOCKS C2 channels
  • Disable unused IIS features/modules and remove unused ASP.NET handlers on internet-facing servers

Longer-term hardening

  • Deploy EDR with behavioral detection tuned for LOLBin masquerading (renamed system binaries), tunneling-tool signatures (Chisel, Cloudflared, revsocks), and mass-PsExec deployment patterns
  • Enforce network segmentation between internet-facing web tiers and internal Active Directory infrastructure
  • Implement application allow-listing on IIS servers to prevent web shell execution
  • Restrict SYSVOL and domain-controller network shares from write access by non-administrative accounts
  • Deploy LSASS protection (Credential Guard, PPL) to block comsvcs.dll-based memory dumping
  • Require MFA for RDP and any newly created local accounts; alert on local account creation on servers

Timeline of Spirals Ransomware

  • 23:33: WMI-based lateral movement commences, using compromised domain administrator credentials harvested via SAM hive and LSASS dumps, spreading to more than a dozen machines within minutes.
  • 23:07: Actor begins disabling Windows Defender real-time monitoring via MpCmdRun.exe and downloads additional tooling, staging some payloads with a .jpg extension to disguise them.
  • ~22:30: Multiple tunneling/reverse-proxy tools deployed for redundant C2 — Chisel (renamed chrome.exe), Cloudflare Tunnel client, tunn.exe, and revsocks.exe reverse-SOCKS proxy on port 443.
  • 22:21 local time: Threat actor compromises internet-facing IIS web server via uploaded ASP.NET web shell, gaining remote command execution through the IIS worker process.
  • Ransom note C:\RECOVERY_SECTION.log deposited on encrypted hosts, directing the victim to a Tor negotiation portal and threatening a six-day public data leak.
  • During the mass-deployment window, the payload forcibly stops 23 backup/database/virtualization services (Veeam, VMware, Hyper-V, SQL Server, Exchange, and others) before encrypting files with per-file AES-128 keys wrapped by an attacker ECDH P-256 public key.
  • 14:44: Deployment cadence accelerates to more than one new target every few seconds for approximately 30 minutes, achieving domain-wide encryption.
  • 14:12: Actor initiates mass PsExec-based deployment of the ransomware payload (running as SYSTEM with base64-encoded PowerShell) across the domain.
  • Security.com (Symantec/Broadcom threat intelligence) publishes technical analysis publicly naming and detailing the Spirals ransomware family and this attack.
  • BleepingComputer, GBHackers, Cyberpress, HelpNetSecurity, and other outlets publish follow-up coverage of the Spirals ransomware campaign.
  • Threat ingested into TL-Intel Harness via Cyber Security News RSS coverage of the campaign.

Sources cited for Spirals Ransomware

Threats related to Spirals Ransomware

Detection coverage for TL-2026-1481

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1481 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats