# Spirals Ransomware: Rust-Based Double Extortion Campaign Against South Asian IT Company

> A previously unseen Rust-based ransomware family named 'Spirals' was deployed in a double-extortion attack against an IT services company in South Asia in June 2026. The entire intrusion, from initial compromise of an internet-facing IIS web server to enterprise-wide encryption, was completed in under 24 hours, demonstrating a high degree of operator sophistication and operational security.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2399
- **ID:** TL-2026-2399
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On June 16, 2026 at approximately 22:21 local time, an unidentified threat actor compromised an internet-facing Microsoft IIS web server belonging to a large IT services company in South Asia. The attackers uploaded an ASP.NET web shell to the IIS worker process (w3wp.exe), which was observed spawning unexpected child processes including cmd.exe and powershell.exe. Within the first ten minutes, the operator deployed four separate tunneling and proxy utilities to establish redundant C2 channels: revsocks (reverse SOCKS5 proxy, SHA256: 4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649), Chisel disguised as chrome.exe (SHA256: 84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d), Cloudflare Tunnel client (cloudflared-windows-amd64.exe, SHA256: b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556), and an unidentified tunnel utility (tunn.exe, SHA256: 7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b). A token impersonation tool (tokens.exe, SHA256: 862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1) was also deployed.

Between 22:31 and 23:07, the operator conducted intensive hands-on-keyboard activity: escalating privileges via UAC bypass, enabling Remote Desktop (modifying the fDenyTSConnections registry value), creating a local administrator account for persistence, enumerating users and network shares, listing installed program directories, and attempting to uninstall endpoint security software. The attacker dumped the SAM registry hive to a password-protected archive for offline password cracking and later extracted LSASS process memory from multiple machines using the living-off-the-land technique rundll32.exe comsvcs.dll, MiniDump during WMI-based lateral movement.

At 23:33, the operator initiated WMI-based lateral movement from the initially compromised host toward other machines using multiple abused accounts, including likely built-in domain administrator accounts. Over a dozen machines were targeted within the first few minutes, with the cadence and command structure consistent with automated lateral movement. The target list appeared to have been pre-compiled from Active Directory enumeration, as it included domain controllers, file servers, application servers, VMs, and workstations with enterprise naming conventions.

The following day at 14:12, a single host began using PsExec (psexec.exe -accepteula -d -s \<target> powershell -nop -w 1 -enc <base64-payload>) to push payloads across the network, hitting more than one new target every few seconds for approximately 30 minutes. The base64-decoded PowerShell payload performed two critical actions on each machine: first, it disabled Windows Defender using MpCmdRun.exe -RemoveDefinitions -All -DisableRealtimeMonitoring $true and Set-MpPreference -DisableIOAVProtection $true; second, it stopped approximately 23 categories of backup, database, and virtualization services including Exchange, Hyper-V, VMware, Veeam, Acronis, Veritas, Commvault, SQL Server, Oracle, MySQL, PostgreSQL, Intuit, SAP, and Lotus Domino to unlock files for encryption.

The Spirals ransomware payload, written in Rust, was delivered under the filename bitsadmin.exe to masquerade as the legitimate Windows Background Intelligent Transfer Service (BITS) utility. It was dropped by a process presenting as svchost.exe and placed in multiple locations: C:\Windows\bitsadmin.exe, the user desktop, the SYSVOL domain scripts directory (for domain-wide replication), and a domain controller network share. A secondary copy named vbr2116.exe was found in the user TEMP directory. The ransomware uses per-file AES-128 encryption keys wrapped with an attacker-controlled ECDH P-256 public key, making decryption impossible without the attacker's private key. Files larger than 5 MB are encrypted intermittently across jittered chunks for speed, rendering large databases and VM images unusable without the time cost of full encryption.

The ransom note, written to C:\RECOVERY_SECTION.log, threatens to publish stolen data within six days if the ransom is not paid and directs victims to a Tor-based negotiation portal where the operators refer to the malware as 'Spirals'. The C2 infrastructure was hosted on 185.141.216.194 (AS26832 RICAWEBSERVICES, Montreal, Canada), with staging URLs including hxxp://185.141.216.194/cd.jpg and hxxp://185.141.216.194/cd.zip for disguised payload delivery, plus two secondary domains (computer.kplus.com and beta.padmin.com) likely compromised third-party sites.

The threat actor remains unattributed to any known group, and Spirals has only been observed in this single incident, leaving it unclear whether it is a new ransomware-as-a-service offering or a tool purpose-built for this attack. Symantec's Threat Hunter Team assessed the operators as skilled professionals capable of launching broader campaigns.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1505.003 Web Shell
- T1136.001 Local Account
- T1548.002 Bypass User Account Control
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1018 Remote System Discovery
- T1087.002 Domain Account
- T1135 Network Share Discovery
- T1047 Windows Management Instrumentation
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1090 Proxy
- T1572 Protocol Tunneling
- T1489 Service Stop

## Sources

- [Spirals: New Stealthy Ransomware Deployed Against Asian IT Company](https://www.security.com/threat-intelligence/ransomware-spirals-extortion)
- [New Spirals ransomware encrypts victim network in under 24 hours](https://www.bleepingcomputer.com/news/security/new-spirals-ransomware-encrypts-victim-network-in-under-24-hours/)
- [Spirals Ransomware Encrypts a Network in Under 24 Hours](https://securityonline.info/spirals-ransomware/)
- [New Spirals Ransomware Identified Following South Asia Attack](https://breachnews.com/ransomware/new-spirals-ransomware-identified-after-attack-on-it-services-firm/)
- [Spirals Ransomware Reference](https://www.manageengine.com/malware-protection/adversaries/spirals-ransomware.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2399