Spirals Ransomware: Rust-Based Double Extortion Campaign Against South Asian IT Company

Spirals Ransomware (TL-2026-2399) is a critical-severity ransomware operation, first published 2026-07-16. It has no confirmed attribution, affects Microsoft Internet Information Services (IIS), maps to 22 MITRE ATT&CK techniques (T1003.001, T1003.002, T1018), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-2399

Threat ID
TL-2026-2399
Severity
CRITICAL
Status
ACTIVE
Category
RANSOMWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
it services professional services
Target regions
["South Asia"]
Detection rules
9
Indicators of compromise
24

Malware and tooling in Spirals Ransomware

Malware and tooling: Spirals, Chisel, CloudFlare Tunnel, Cloudflared, PSEXEC, Tor negotiation portal, revsocks

A previously unseen Rust-based ransomware family named 'Spirals' was deployed in a double-extortion attack against an IT services company in South Asia in June 2026. The entire intrusion, from initial compromise of an internet-facing IIS web server to enterprise-wide encryption, was completed in under 24 hours, demonstrating a high degree of operator sophistication and operational security.

How Spirals Ransomware works

On June 16, 2026 at approximately 22:21 local time, an unidentified threat actor compromised an internet-facing Microsoft IIS web server belonging to a large IT services company in South Asia. The attackers uploaded an ASP.NET web shell to the IIS worker process (w3wp.exe), which was observed spawning unexpected child processes including cmd.exe and powershell.exe. Within the first ten minutes, the operator deployed four separate tunneling and proxy utilities to establish redundant C2 channels: revsocks (reverse SOCKS5 proxy, SHA256: 4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649), Chisel disguised as chrome.exe (SHA256: 84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d), Cloudflare Tunnel client (cloudflared-windows-amd64.exe, SHA256: b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556), and an unidentified tunnel utility (tunn.exe, SHA256: 7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b). A token impersonation tool (tokens.exe, SHA256: 862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1) was also deployed.

Between 22:31 and 23:07, the operator conducted intensive hands-on-keyboard activity: escalating privileges via UAC bypass, enabling Remote Desktop (modifying the fDenyTSConnections registry value), creating a local administrator account for persistence, enumerating users and network shares, listing installed program directories, and attempting to uninstall endpoint security software. The attacker dumped the SAM registry hive to a password-protected archive for offline password cracking and later extracted LSASS process memory from multiple machines using the living-off-the-land technique rundll32.exe comsvcs.dll, MiniDump during WMI-based lateral movement.

At 23:33, the operator initiated WMI-based lateral movement from the initially compromised host toward other machines using multiple abused accounts, including likely built-in domain administrator accounts. Over a dozen machines were targeted within the first few minutes, with the cadence and command structure consistent with automated lateral movement. The target list appeared to have been pre-compiled from Active Directory enumeration, as it included domain controllers, file servers, application servers, VMs, and workstations with enterprise naming conventions.

The following day at 14:12, a single host began using PsExec (psexec.exe -accepteula -d -s \<target> powershell -nop -w 1 -enc <base64-payload>) to push payloads across the network, hitting more than one new target every few seconds for approximately 30 minutes. The base64-decoded PowerShell payload performed two critical actions on each machine: first, it disabled Windows Defender using MpCmdRun.exe -RemoveDefinitions -All -DisableRealtimeMonitoring $true and Set-MpPreference -DisableIOAVProtection $true; second, it stopped approximately 23 categories of backup, database, and virtualization services including Exchange, Hyper-V, VMware, Veeam, Acronis, Veritas, Commvault, SQL Server, Oracle, MySQL, PostgreSQL, Intuit, SAP, and Lotus Domino to unlock files for encryption.

The Spirals ransomware payload, written in Rust, was delivered under the filename bitsadmin.exe to masquerade as the legitimate Windows Background Intelligent Transfer Service (BITS) utility. It was dropped by a process presenting as svchost.exe and placed in multiple locations: C:\Windows\bitsadmin.exe, the user desktop, the SYSVOL domain scripts directory (for domain-wide replication), and a domain controller network share. A secondary copy named vbr2116.exe was found in the user TEMP directory. The ransomware uses per-file AES-128 encryption keys wrapped with an attacker-controlled ECDH P-256 public key, making decryption impossible without the attacker's private key. Files larger than 5 MB are encrypted intermittently across jittered chunks for speed, rendering large databases and VM images unusable without the time cost of full encryption.

The ransom note, written to C:\RECOVERY_SECTION.log, threatens to publish stolen data within six days if the ransom is not paid and directs victims to a Tor-based negotiation portal where the operators refer to the malware as 'Spirals'. The C2 infrastructure was hosted on 185.141.216.194 (AS26832 RICAWEBSERVICES, Montreal, Canada), with staging URLs including hxxp://185.141.216.194/cd.jpg and hxxp://185.141.216.194/cd.zip for disguised payload delivery, plus two secondary domains (computer.kplus.com and beta.padmin.com) likely compromised third-party sites.

The threat actor remains unattributed to any known group, and Spirals has only been observed in this single incident, leaving it unclear whether it is a new ransomware-as-a-service offering or a tool purpose-built for this attack. Symantec's Threat Hunter Team assessed the operators as skilled professionals capable of launching broader campaigns.

MITRE ATT&CK techniques used in TL-2026-2399

Credential Access

T1003.001 LSASS Memory; T1003.002 Security Account Manager

Discovery

T1018 Remote System Discovery; T1087.002 Domain Account; T1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location

execution

T1047 Windows Management Instrumentation

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Command and Control

T1090 Proxy; T1572 Protocol Tunneling

Privilege Escalation

T1134 Access Token Manipulation; T1548.002 Bypass User Account Control

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Spirals Ransomware

  • Microsoft — Internet Information Services (IIS)
    Vulnerable versions: Any internet-exposed IIS version
  • Microsoft — Windows Server
    Vulnerable versions: Windows Server 2019; Windows Server 2022
  • Microsoft — Active Directory
    Vulnerable versions: Domain-joined environments with permissive WMI/PsExec access
  • Microsoft — Windows Defender
    Vulnerable versions: Versions without tamper protection enabled

Remediation for Spirals Ransomware

Immediate actions

  • Isolate compromised IIS servers and scan for ASP.NET web shells in web application directories
  • Block C2 IP 185.141.216.194 and staging domains (computer.kplus.com, beta.padmin.com) at network perimeter
  • Enforce LSASS as Protected Process Light (RunAsPPL) or deploy Windows Defender Credential Guard across all domain-joined systems
  • Audit for unrecognized local administrator accounts and remove unauthorized accounts immediately
  • Review and restrict WMI and PsExec remote execution permissions via Group Policy; limit to authorized administrative jump hosts
  • Enable Windows Defender tamper protection and verify real-time monitoring is active on all endpoints

Workarounds

  • Monitor IIS worker process (w3wp.exe) for unexpected child process creation (cmd.exe, powershell.exe)
  • Restrict outbound connections from servers to only approved destinations via firewall allowlist, including port 443
  • Deploy canary files in SYSVOL, network shares, and domain controller shared folders to detect mass encryption and file access patterns
  • Enable PowerShell script block logging and AMSI (Anti-Malware Scan Interface) to detect base64-encoded malicious payloads
  • Implement DCSync protection measures and audit Active Directory replication rights

Longer-term hardening

  • Harden internet-facing IIS servers by reducing attack surface, implementing Web Application Firewall (WAF) rules, enforcing least-privilege application pool identities, and conducting regular web shell scans
  • Implement tiered administration model with dedicated Privileged Access Workstations (PAWs) and jump hosts for domain admin activities
  • Deploy behavioral detection rules for mass WMI and PsExec execution events, LSASS process access attempts, and Windows Defender disablement patterns
  • Maintain offline or immutable backups on separate network segments with regular restore testing
  • Implement network segmentation to restrict lateral movement between server tiers, workstation zones, and critical assets
  • Deploy endpoint detection and response (EDR) solutions with behavioral ransomware detection capabilities

Timeline of Spirals Ransomware

  • At 23:33, WMI-based lateral movement begins from initially compromised host; more than a dozen machines targeted within minutes using multiple abused domain administrator accounts with automated cadence
  • Attempts to uninstall endpoint security software using wmic and mpcmdrun.exe; security tool disablement initiated on compromised hosts
  • SAM registry hive dumped to password-protected archive; token impersonation tool (tokens.exe) deployed to aid privilege escalation
  • Between 22:31 and 23:07, operator conducts intensive hands-on-keyboard session via web shell: UAC bypass performed, RDP enabled, local administrator account created, users and network shares enumerated, installed program directories listed
  • At 22:21 local time, first malicious activity observed; four tunneling/proxy utilities (revsocks, Chisel disguised as chrome.exe, Cloudflare Tunnel client, tunn.exe) deployed within 10 minutes of initial access to establish redundant C2 channels
  • Threat actor compromises internet-facing IIS web server and uploads ASP.NET web shell to the compromised host
  • Ransom note dropped as C:\RECOVERY_SECTION.log on encrypted systems, threatening publication of stolen data within six days if ransom not paid, directing victims to Tor-based negotiation portal where operators refer to ransomware as 'Spirals'
  • Enterprise-wide file encryption executed using per-file AES-128 keys wrapped with ECDH P-256 public key; files larger than 5 MB encrypted intermittently across jittered chunks; entire intrusion from initial access to encryption completed in under 24 hours
  • Spirals ransomware payload (named bitsadmin.exe, written in Rust) deployed via PsExec as SYSTEM to multiple locations including C:\Windows\, SYSVOL domain scripts directory, and domain controller network share for domain-wide replication
  • At 14:44, PsExec pushes base64-encoded PowerShell payload under SYSTEM context: disables Windows Defender (threat definitions removal, real-time monitoring disabled) and stops ~23 backup, database, and virtualization services
  • At 14:12, PsExec mass deployment begins from single host, pushing payload to extensive target list at rate exceeding one new target every few seconds
  • LSASS process memory dumped on multiple machines during WMI lateral movement using rundll32.exe with comsvcs.dll (MiniDump API) via living-off-the-land technique
  • BleepingComputer and other cybersecurity news outlets report on Spirals ransomware attack, amplifying IOC dissemination to the security community
  • Symantec Threat Hunter Team (Broadcom) publishes comprehensive technical analysis of Spirals ransomware including indicators of compromise, file hashes, and network indicators

Sources cited for Spirals Ransomware

More in ransomware

Detection coverage for TL-2026-2399

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2399 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats