NightSpire Ransomware Uses RDP Access and Remote Admin Tools for Stealthy Persistence

Cybersecuritynews •Tushar Subhra Dutta • May 26, 2026

A new ransomware threat is making waves across dozens of industries and countries, using a surprisingly simple but effective approach to break into systems and lock victims out of their own data. NightSpire, first identified in early 2025, has already shown it is willing to cast a wide net, hitting hospitals, schools, government offices, and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NightSpire Ransomware Exploits RDP for Widespread Attacks NightSpire ransomware, identified in early 2025, has rapidly become a significant threat, employing double-extortion tactics. It targets various sectors, including hospitals and government offices, by exploiting Remote Desktop Protocol (RDP) vulnerabilities and remote admin tools. Victims face data encryption and potential exposure of sensitive files on a Tor leak site if ransoms are not paid. The ransomware's impact spans multiple industries and countries, indicating a broad operational scope. As of May 2026, the threat remains active, with ongoing attacks reported across diverse organizations. Security professionals are urged to enhance RDP security measures to mitigate risks associated with NightSpire. 3 sources 67

Extracted Entities

NightSpire Ransomware Uses RDP Access and Remote Admin Tools for Stealthy Persistence

The full story

Extracted Entities

Attack Types (1)

Industries (1)

MITRE ATT&CK (2)

Ransomware Groups (1)