# Spirals Ransomware — New Rust-Based Family Breaches Internet-Facing IIS Server, Encrypts Entire Domain Within 24 Hours

> A previously unseen Rust-based ransomware family named Spirals compromised an internet-facing IIS web server at an IT services company in South Asia on June 16, 2026 via an ASP.NET web shell, then used Chisel, Cloudflared, and revsocks tunneling tools plus PsExec-based mass deployment to achieve full domain-wide encryption within 24 hours. The malware pairs per-file AES-128 encryption with ECDH P-256 key wrapping and intermittent encryption of large files, disabled Windows Defender and 23 backup/database/virtualization services, and threatens a six-day public data leak via a Tor negotiation portal.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1481
- **ID:** TL-2026-1481
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 16, 2026 at 22:21 local time, an unidentified threat actor compromised an internet-facing Microsoft IIS web server belonging to an IT services company in South Asia by uploading an ASP.NET web shell, granting remote command execution through the IIS worker process (w3wp.exe). Within minutes the actor staged multiple tunneling and reverse-proxy tools for redundant, encrypted command-and-control channels: a Chisel binary renamed to chrome.exe, a Cloudflare Tunnel client (cloudflared-windows-amd64.exe) providing outbound HTTPS-based C2, a generic tunneling utility (tunn.exe), and a reverse-SOCKS proxy (revsocks.exe) bound to external port 443. A token-impersonation tool (tokens.exe) was used for local privilege escalation alongside a UAC bypass, and the actor enabled RDP and created a local account for persistent access.

At 23:07 the actor began disabling Windows Defender via MpCmdRun.exe (-RemoveDefinitions -All -DisableRealtimeMonitoring $true -DisableIOAVProtection $true) and downloaded additional tooling, staging some payloads with a .jpg extension to disguise their content during transfer. Credential harvesting followed: the SAM registry hive was dumped to a password-protected archive, and LSASS process memory was dumped on multiple hosts using rundll32.exe in combination with comsvcs.dll (the MiniDump export technique). These credentials, combined with compromised domain-administrator accounts, enabled WMI-based lateral movement beginning at 23:33 against more than a dozen machines within minutes.

On June 17 at 14:12 the actor pivoted to mass deployment using PsExec run as SYSTEM (psexec.exe -accepteula -d -s \\<target> powershell -nop -w 1 -enc <base64 payload>), placing the ransomware binary — deployed under decoy filenames bitsadmin.exe and vbr2116.exe to masquerade as a legitimate Windows utility — into the SYSVOL domain scripts directory (sysvol_dfsr\domain\scripts) and a domain-controller network share for enterprise-wide propagation. By 14:44 the deployment cadence accelerated to more than one new target every few seconds, encrypting machines across the environment during a roughly 30-minute mass-push window. Before detonation the payload forcibly stopped 23 backup, database, and virtualization services — including Veeam, VMware, Hyper-V, Acronis, Veritas, Commvault, SQL Server, Oracle, MySQL, PostgreSQL, Exchange, Intuit, SAP, and Lotus Domino — to maximize both encryption impact and recovery difficulty.

The ransomware itself is a full-featured Rust binary implementing defense evasion, encryption, lateral movement, process termination, obfuscation, and privilege-escalation capability. Each file is encrypted with a unique per-file AES-128 key; those keys are wrapped with an attacker-controlled ECDH P-256 public key so only the attacker's matching private key can recover them. Files larger than 5MB are encrypted intermittently in jittered chunks rather than in full, a common ransomware speed optimization that also complicates some entropy-based detection heuristics. A ransom note (C:\RECOVERY_SECTION.log) was dropped instructing the victim to negotiate via a Tor hidden-service portal that explicitly names the operation "Spirals," and threatens publication of exfiltrated data within six days of non-payment — a classic double-extortion model. The overall operation, from initial web-shell access to full domain encryption, took under 24 hours, with the actor's hands-on-keyboard activity spanning roughly three hours of interactive reconnaissance, Active Directory enumeration, and target-list compilation prior to the automated mass-deployment phase. No attribution to a known ransomware group or affiliate program has been established as of this reporting; "Spirals" is treated as a newly identified, previously unseen ransomware family/brand.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1136 Create Account
- T1219 Remote Access Tools
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1047 Windows Management Instrumentation
- T1570 Lateral Tool Transfer
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1572 Protocol Tunneling
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [New Spirals Ransomware](https://cybersecuritynews.com/new-spirals-ransomware/)
- [Spirals: New Stealthy Ransomware Deployed Against Asian IT Company](https://www.security.com/threat-intelligence/ransomware-spirals-extortion)
- [New Spirals ransomware encrypts victim network in under 24 hours](https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/)
- [Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems](https://cyberpress.org/spirals-ransomware-silences-defenses/)
- [Hackers Breached an IIS Server and Deployed Ransomware Across the Network the Next Day](https://gbhackers.com/iis-server-breached/)
- [Spirals ransomware locks down victim systems in under 24 hours](https://www.helpnetsecurity.com/2026/07/17/spirals-ransomware-south-asia/)
- [Spirals: New Stealthy Ransomware Deployed Against Asian IT Company - Threat Radar](https://radar.offseq.com/threat/spirals-new-stealthy-ransomware-deployed-against-a-66e64dea6bf45ffb)
- [New Spirals ransomware can lock down an entire network in under 24 hours](https://www.pcquest.com/security-products/new-spirals-ransomware-can-lock-down-an-entire-network-in-under-24-hours-12170579)
- [ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories](https://thehackernews.com/2026/07/threatsday-game-cheat-spyware-24-hour.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1481