NightSpire Ransomware Exploits RDP for Widespread Attacks

NightSpire ransomware, identified in early 2025, has rapidly become a significant threat, employing double-extortion tactics. It targets various sectors, including hospitals and government offices, by exploiting Remote Desktop Protocol (RDP) vulnerabilities and remote admin tools. Victims face data encryption and potential exposure of sensitive files on a Tor leak site if ransoms are not paid. The ransomware's impact spans multiple industries and countries, indicating a broad operational scope. As of May 2026, the threat remains active, with ongoing attacks reported across diverse organizations. Security professionals are urged to enhance RDP security measures to mitigate risks associated with NightSpire.

Key Points: • NightSpire ransomware uses RDP and remote admin tools for stealthy intrusions. • It employs double-extortion tactics, encrypting data and threatening exposure on Tor. • The ransomware has impacted hospitals, schools, and government offices across multiple countries.