# Spirals Ransomware

Ransomware (double extortion) · Written in Rust · First observed June 2026 · Breach-to-encryption under 24 hours

## Overview

Spirals is a Rust-based ransomware family first documented in a July 16, 2026 BleepingComputer report on independent threat-hunting findings. It was used in a double-extortion attack against an IT services company in South Asia in June 2026. The operator went from initial compromise of an internet-facing IIS web server to full network encryption in under 24 hours, with no exploit chain and no zero-day involved.

The intrusion is notable less for the ransomware binary itself and more for the operational tempo behind it. In a single concentrated hands-on-keyboard session, the operator established multiple redundant covert access channels, escalated privileges, dumped credential material, disabled security tooling, moved laterally to more than a dozen systems, and pushed the encryptor network-wide, all inside one calendar day. Cyber Security News reports that the rapid, sequential nature of the deployment suggests the target list was assembled in advance rather than discovered through manual exploration.

Spirals has so far been confirmed against a single victim network. Help Net Security's coverage of the underlying research notes that investigators still assessed the operators as skilled enough to run broader campaigns, despite the limited confirmed footprint. The threat actor behind Spirals has not been publicly attributed to a known group.

Spirals is a full-featured encryptor: it disables endpoint defenses, harvests credentials, moves laterally using native Windows administration tools, and encrypts using a modern per-file key scheme wrapped in an attacker-controlled asymmetric key. It does not itself perform data exfiltration in a documented, named mechanism; the double-extortion threat rests on data theft claimed in the ransom note and negotiation portal rather than on a mechanism current public reporting details in full.

File-level indicators for this intrusion, including the ransomware payload, the tunneling tools, and the credential-access utility, have been shared through community threat-intelligence channels including AlienVault OTX. [VirusTotal](https://www.virustotal.com/) is the recommended place to check current multi-engine detection coverage and file relationships for the hashes listed in the IOC section below, since detection ratios for a single-incident sample change over time as vendors update signatures.

**Verification note:** the specific IIS vulnerability, plugin flaw, or credential weakness used for initial access has not been publicly disclosed in current reporting. Treat the initial-access vector as "compromised internet-facing IIS server" rather than a named CVE until further detail is published. The exact exfiltration mechanism used to stage the claimed data theft is likewise undocumented in public reporting as of this writing.

### 90-second summary

- **How it got in:** an internet-facing IIS web server was compromised and an ASP.NET web shell uploaded; the specific vulnerability is not publicly named.
- **How fast:** breach to full network encryption in under 24 hours, with a concentrated three-hour hands-on-keyboard session driving most of the damage on night one.
- **What it used:** four tunneling/remote-access tools within about 10 minutes (tunn.exe, revsocks, Chisel disguised as chrome.exe, and a Cloudflare Tunnel client), a UAC bypass, RDP enablement, SAM and LSASS credential dumps, a token-impersonation tool (tokens.exe), and WMI plus PsExec for lateral movement.
- **What it hit before encrypting:** Windows Defender disabled and roughly 20-23 backup, database, and virtualization services stopped (Veeam, VMware, Hyper-V, SQL Server, Oracle, PostgreSQL, Exchange, and others), specifically to disable recovery options.
- **The encryptor:** runs as bitsadmin.exe, staged in multiple locations including SYSVOL and a domain-controller share for domain-wide reach; uses AES-128 per file wrapped with an attacker-controlled ECDH P-256 key, and files over 5MB are encrypted in chunks.
- **The extortion:** ransom note `C:\RECOVERY_SECTION.log`, Tor negotiation portal, 6-day deadline before threatened data publication.

### Threat profile

| Field | Value |
|---|---|
| Type | Ransomware (double extortion) |
| First seen | June 2026 |
| Breach-to-encrypt | Under 24 hours |
| Attribution | Unattributed |
| Written in | Rust |
| Confirmed victims | 1 (South Asia, IT services company) |
| Initial access | Internet-facing IIS server, ASP.NET web shell |
| Encryption | AES-128 per file, ECDH P-256 key wrap |
| Payload alias | bitsadmin.exe |
| Ransom note | RECOVERY_SECTION.log |
| Extortion deadline | 6 days, Tor negotiation portal |

## Operational attack chain · IIS web shell to network-wide encryption

1. **IIS server compromised**  
   ASP.NET web shell uploaded to an internet-facing IIS web server.
2. **Covert access channels (Stage 1)**  
   Chisel, revsocks, and Cloudflare Tunnel deployed within roughly ten minutes.
3. **Privilege escalation and persistence (Stage 2)**  
   UAC bypass · RDP enabled · local account created · SAM hive dumped.
4. **Defenses disabled (Stage 3)**  
   Security tooling tampering attempted roughly 90 minutes after the initial breach.
5. **WMI lateral movement (Stage 4)**  
   12+ hosts reached via domain administrator credentials.
6. **PsExec mass push (Stage 5)**  
   Defender disabled and backup/database/virtualization services stopped across targets.
7. **Impact: Network-wide encryption**  
   bitsadmin.exe encryptor · double extortion via Tor negotiation portal.

The entire sequence, initial access through encryption, ran inside roughly 16 hours across two calendar days. No stage relied on a software exploit after the initial IIS compromise; every subsequent step used native Windows tooling or publicly available tunneling utilities.

## Tactics, techniques, and procedures

Spirals maps across the full intrusion lifecycle rather than clustering in one or two tactics. The heaviest technique density sits in Lateral Movement, Command and Control, and Credential Access, reflecting an operator that prioritized speed and redundancy over stealth.

### MITRE ATT&CK coverage

| Tactic | Techniques | What Spirals does |
|---|---|---|
| Initial Access | [Exploit Public-Facing Application T1190](https://attack.mitre.org/techniques/T1190/) | An internet-facing IIS web server was compromised and an ASP.NET web shell uploaded. The specific vulnerability or misconfiguration is not named in current public reporting. Defender telemetry: IIS worker process (`w3wp.exe`) spawning unexpected child processes. |
| Execution | [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/)<br>[Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/)<br>[Service Execution T1569.002](https://attack.mitre.org/techniques/T1569/002/) | The web shell spawned `cmd.exe` and `powershell.exe` through the IIS worker process for the hands-on-keyboard session. Later, PsExec created a temporary Windows service on each target host to execute a base64-encoded PowerShell payload as SYSTEM. |
| Persistence | [Server Software Component: Web Shell T1505.003](https://attack.mitre.org/techniques/T1505/003/)<br>[Create Account: Local Account T1136.001](https://attack.mitre.org/techniques/T1136/001/) | The ASP.NET web shell itself is a durable re-entry point on the IIS server. During the session, the operator also created a new local account to maintain access independent of the web shell. |
| Privilege Escalation | [Bypass User Account Control T1548.002](https://attack.mitre.org/techniques/T1548/002/)<br>[Access Token Manipulation T1134](https://attack.mitre.org/techniques/T1134/) | A UAC bypass was performed early in the session. A token-impersonation utility (`tokens.exe`) was also deployed and is assessed as a likely token-manipulation aid. |
| Defense Evasion | [Disable or Modify Tools T1562.001](https://attack.mitre.org/techniques/T1562/001/)<br>[Obfuscated Files or Information T1027](https://attack.mitre.org/techniques/T1027/)<br>[Match Legitimate Name or Location T1036.005](https://attack.mitre.org/techniques/T1036/005/) | Endpoint security was tampered with early. The payload was base64-encoded, and the ransomware was named `bitsadmin.exe`. A tunneling tool was disguised as `chrome.exe`; one sample was dropped by a process presenting as `svchost.exe`. |
| Credential Access | [Security Account Manager T1003.002](https://attack.mitre.org/techniques/T1003/002/)<br>[LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/) | The SAM hive was dumped. LSASS memory was dumped using `rundll32.exe` invoking `comsvcs.dll`'s MiniDump export. |
| Discovery | [Remote System Discovery T1018](https://attack.mitre.org/techniques/T1018/)<br>[Domain Account Discovery T1087.002](https://attack.mitre.org/techniques/T1087/002/)<br>[File and Directory Discovery T1083](https://attack.mitre.org/techniques/T1083/)<br>[Network Share Discovery T1135](https://attack.mitre.org/techniques/T1135/) | Lateral movement cadence indicates rapid enumeration through Active Directory and network shares, including identification of SYSVOL and domain-controller shares. |
| Lateral Movement | [Windows Management Instrumentation T1047](https://attack.mitre.org/techniques/T1047/)<br>[SMB/Windows Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/)<br>[Remote Desktop Protocol T1021.001](https://attack.mitre.org/techniques/T1021/001/)<br>[Lateral Tool Transfer T1570](https://attack.mitre.org/techniques/T1570/) | WMI used to reach 12+ hosts. PsExec became the primary mass-deployment vector. Ransomware copied to SYSVOL and a DC-hosted share for extended reach. |
| Command and Control | [Protocol Tunneling T1572](https://attack.mitre.org/techniques/T1572/)<br>[Proxy T1090](https://attack.mitre.org/techniques/T1090/)<br>[Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/) | Chisel (as `chrome.exe`), revsocks, and Cloudflare Tunnel established redundant covert HTTPS-based channels. |
| Exfiltration | [Exfiltration Over Web Service T1567](https://attack.mitre.org/techniques/T1567/) | Data theft is claimed in the ransom note; the specific staging or transfer mechanism is not documented publicly. |
| Impact | [Service Stop T1489](https://attack.mitre.org/techniques/T1489/)<br>[Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/) | Windows Defender disabled; ~20 backup/database/virtualization services stopped; Rust-based encryptor run as `bitsadmin.exe`. |

## Indicators of compromise

Durable indicators (file paths, process patterns, and network behaviors) are listed separately from volatile indicators such as hashes and infrastructure.

### File and path indicators

- `C:\RECOVERY_SECTION.log` — ransom note dropped on encrypted hosts.
- `bitsadmin.exe` (outside `%SystemRoot%\System32`) — ransomware payload; reported at `%SystemRoot%`, desktop, SYSVOL scripts, and a DC-hosted share.
- `%TEMP%\vbr2116.exe` — renamed Spirals sample, dropped by a process presenting as `svchost.exe`.
- `SYSVOL\...\scripts\*` — reported payload staging location for domain-wide reach.
- `...\public\tunn.exe` and `...\Windows\tasks\tunn.exe` — tunneling tool staging locations.
- `...\Windows\tasks\revsocks.exe` — reverse SOCKS proxy tool.
- `chrome.exe` (non-browser install path) — Chisel tunnel client disguised under a browser name.
- `cloudflared-windows-amd64.exe` — Cloudflare Tunnel client dropped in a web production directory.
- `tokens.exe` — token-impersonation utility.

### Process tree patterns

- `w3wp.exe → cmd.exe / powershell.exe` — web shell driving command execution.
- `rundll32.exe comsvcs.dll, MiniDump [PID] lsass.dmp full` — living-off-the-land LSASS dump.
- `wmiprvse.exe → powershell.exe [identical payload]` — WMI-based lateral movement.
- `services.exe (PSEXESVC) → powershell.exe [repeated]` — PsExec mass push.
- `powershell.exe → MpCmdRun.exe / Stop-Service [backup/DB/virt service]` — pre-encryption defense disablement and service disruption.

### File hashes (verify on VirusTotal)

Each SHA256 can be checked at [https://www.virustotal.com/](https://www.virustotal.com/).

- `0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141` — bitsadmin.exe, vbr2116.exe (ransomware payload)
- `4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649` — revsocks.exe
- `7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b` — tunn.exe
- `83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892` — unidentified suspicious file
- `84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d` — chrome.exe (Chisel)
- `862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1` — tokens.exe
- `b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556` — cloudflared-windows-amd64.exe

## Where Malware Protection Plus fits

Spirals is a behavioral-detection problem more than a signature problem. The binary itself is unremarkable Rust code; the intrusion is identifiable through the sequence of anomalous parent-child relationships, credential access, lateral movement, and service disruption that precedes encryption.

[Malware Protection Plus](https://www.manageengine.com/malware-protection/) helps security teams detect suspicious endpoint behavior as it happens, isolate affected systems before the encryptor reaches every host, investigate the root cause across the web shell, credential-dumping, and lateral-movement stages, and support faster restoration of affected endpoints once the incident is contained. It does not replace patching the exposed IIS server, monitoring the domain, or maintaining offline backups.

## What defenders can detect

1. **IIS worker process spawning a shell**  
   Monitor for `w3wp.exe` spawning `cmd.exe` or `powershell.exe`.  
   *Why it matters:* high-confidence signal of an active web shell.

2. **Rapid, multi-tool tunneling deployment**  
   Monitor for multiple tunneling tools (Chisel, revsocks, Cloudflare Tunnel) installed within a short window.  
   *Why it matters:* redundant covert channels indicate scripted intrusion.

3. **UAC bypass followed by RDP and account changes**  
   Correlate UAC bypass with `fDenyTSConnections` changes, new local accounts, and SAM access.  
   *Why it matters:* escalation → remote access → credential harvest sequence.

4. **LSASS access via rundll32 and comsvcs.dll**  
   Monitor for `rundll32.exe comsvcs.dll, MiniDump` targeting LSASS.  
   *Why it matters:* fileless credential dumping.

5. **Identical process creation across many hosts**  
   Monitor for the same base64-encoded PowerShell command across numerous hosts within minutes.  
   *Why it matters:* strongest cross-host ransomware precursor signal.

6. **Security tool tampering followed by backup/database service stops**  
   Detect Defender disablement followed by service stops for Veeam, VMware, Hyper-V, SQL Server, Oracle, PostgreSQL, Exchange, etc.  
   *Why it matters:* clear pre-encryption behavior.

## Hardening recommendations

1. **Reduce and monitor the internet-facing IIS attack surface** (Standard)  
   Inventory and patch all exposed IIS servers; remove unused ASP.NET components; monitor for unauthorized file drops.

2. **Restrict and monitor PsExec and WMI remote execution** (Standard)  
   Limit which accounts can use admin shares and WMI; alert on PSEXESVC service creation.

3. **Enable LSASS protection** (Quick win)  
   Enable RunAsPPL or Credential Guard to block LSASS dumping.

4. **Restrict domain administrator account usage** (Standard)  
   Implement AD tiering; prevent routine logon with domain admin credentials.

5. **Isolate and protect backup infrastructure** (Quick win)  
   Maintain offline or immutable backups; ensure backup accounts are not domain administrators.

## Incident response priorities for a suspected Spirals intrusion

1. Isolate affected endpoints, including the IIS server.
2. Preserve forensic artifacts (web shell files, logs, memory captures).
3. Identify patient zero and all WMI/PsExec-touched machines.
4. Disable compromised accounts and reset credentials.
5. Rotate credentials exposed via SAM or LSASS dumps.
6. Validate backup integrity.
7. Hunt for tunneling tools across the environment.
8. Remediate the underlying IIS vulnerability before restoring service.
9. Assume data exfiltration and begin breach-notification assessment.

## Primary references

- [Help Net Security — Spirals ransomware locks down victim systems in under 24 hours](https://www.helpnetsecurity.com/2026/07/17/spirals-ransomware-south-asia/)
- [Cyber Security News — New Spirals ransomware uses IIS web shell and PsExec to encrypt IT firm in under 24 hours](https://cybersecuritynews.com/new-spirals-ransomware/)
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/)
- [VirusTotal — multi-engine file lookup](https://www.virustotal.com/)
- [AlienVault OTX — community indicator sharing](https://otx.alienvault.com/)