NightSpire Ransomware Abuses RDP for Stealthy Persistence

Gbhackers •Mayura Kathir • May 26, 2026

NightSpire has quickly emerged as a significant ransomware threat since its discovery in early 2025, combining classic double-extortion tactics with stealthy intrusion techniques. The malware not only encrypts victim data but also exfiltrates sensitive files, threatening to publish them on a Tor-based leak site if ransom demands are not met. In just a three-month window […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NightSpire Ransomware Exploits RDP for Widespread Attacks NightSpire ransomware, identified in early 2025, has rapidly become a significant threat, employing double-extortion tactics. It targets various sectors, including hospitals and government offices, by exploiting Remote Desktop Protocol (RDP) vulnerabilities and remote admin tools. Victims face data encryption and potential exposure of sensitive files on a Tor leak site if ransoms are not paid. The ransomware's impact spans multiple industries and countries, indicating a broad operational scope. As of May 2026, the threat remains active, with ongoing attacks reported across diverse organizations. Security professionals are urged to enhance RDP security measures to mitigate risks associated with NightSpire. 3 sources 67

Extracted Entities

NightSpire Ransomware Abuses RDP for Stealthy Persistence

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Ransomware Groups (1)