New Spirals ransomware can lock down an entire network in under 24 hours

A newly documented ransomware family called Spirals moved from initial access to data theft and network wide encryption in less than 24 hours. The incident is a wake up call for enterprise defenders since the response window may now be measured in hours instead of days.

The attack hit an IT services company in South Asia after an internet facing Microsoft Internet Information Services IIS server was compromised. The attackers uploaded an ASP.NET web shell, escalated privileges, enabled Remote Desktop Protocol, created a local account, and tried to steal credentials from the Security Account Manager database and the Local Security Authority Subsystem Service process.

Once inside, the operator used Windows Management Instrumentation to move laterally across more than a dozen systems. Multiple remote access channels including Chisel, revsocks, and Cloudflare Tunnel gave them backup ways into the environment.

That kind of redundancy matters. Shutting down one connection would not kick the attacker out, and each extra access path could slow down containment.

The attackers also used PowerShell to disable Microsoft Defender, remove its threat definitions, and stop services tied to 23 backup, database, and virtualization products. The affected software included Veeam, VMware, Hyper V, SQL Server, Oracle, and PostgreSQL.

Stopping these services serves two purposes. It makes more files available for encryption and weakens recovery options before the ransomware is deployed.

Spirals leaned heavily on tools that admins use every day. Windows Management Instrumentation helped with lateral movement while PsExec was used to push the ransomware with SYSTEM level privileges.

The ransomware executable was named bitsadmin.exe , likely to look like Microsoft’s legitimate Background Intelligent Transfer Service utility. That kind of naming does not make it safe, but it can make suspicious activity easier to miss during a fast moving incident.

The payload is written in Rust and uses AES 128 for file encryption. Its encryption keys are protected using elliptic curve Diffie Hellman based on the P 256 curve. Files larger than 5 MB are encrypted in chunks instead of fully, which speeds up the process of making them unusable.

Spirals also uses double extortion. The attackers steal data before encryption and leave a ransom note named RECOVERY_SECTION.log . Victims are warned that the stolen data may be published within six days if payment talks fail.

This means backups alone may not be enough. Even if an organization restores its systems, it could still face legal, regulatory, and reputational fallout from exposed data.

Only one confirmed Spirals incident has been reported so far, so it is too early to say if this will turn into a broader campaign. The takeaway is pretty clear though. Defenders should watch for early warning signs like unexpected web shells, credential dumping, unusual PowerShell activity, unauthorized tunneling tools, and remote execution from admin systems.

Copy-Paste This Command and You’re Hacked: New Windows Terminal Attack Spreads Lumma Stealer

Rethinking identity: Inside the real risks behind modern cybersecurity

India wants AI to stop hackers but the password door is still open

Are Hackers Targeting Windows First While Macs Fly Under the Radar in India?