Leveling Up with NightSpire Ransomware
Huntress analyzed recent NightSpire ransomware incidents, noting a shift from using native LOLBins to deploying a suite of third-party tools for persistence, discovery, and exfiltration. The variation in TTPs and tooling between incidents suggests NightSpire may operate under a Ransomware-as-a-Service (RaaS) model with multiple affiliates.
- email[email protected]Contact email address provided in the December 2025 ransom note
- emailprince1990905@gmail[.]comEmail address associated with Chrome Remote Desktop persistence mechanism
- sha256ad67031e2ca68764fe1a7d6632c02b02a299d59efb920710011a9a2ccf4399b7SHA256 hash for NightSpire file encryptor (enc.exe) from March 25, 2026
- sha256bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355SHA256 hash for NightSpire file encryptor (enc.exe) from December 2, 2025
- urlhxxp://nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd[.]onionNightSpire leak and chat site referenced in the March 2026 ransom note
Key Takeaways
- NightSpire ransomware attacks exhibit varying TTPs, suggesting a potential Ransomware-as-a-Service (RaaS) model or evolving affiliate structure.
- Recent incidents show attackers 'trucking in' third-party tools (AnyDesk, Chrome Remote Desktop, MEGASync, Everything) rather than relying on native LOLBins.
- Persistence is achieved via remote access tools installed as Windows services or startup items.
- The ransomware encryptor and ransom notes have evolved between December 2025 and March 2026.
Affected Systems
- Windows endpoints
Attack Chain
The threat actor gained initial access via RDP and established persistence by installing Chrome Remote Desktop and AnyDesk as services and startup items. For discovery and staging, the attacker utilized the 'Everything' file search tool and 7Zip to archive targeted data. Exfiltration was conducted using MEGASync, followed by the deployment of the NightSpire ransomware encryptor, which appended the .nspire extension to files and dropped ransom notes.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules, but includes file hashes, file paths, and behavioral indicators suitable for threat hunting and custom rule creation.
Detection Engineering Assessment
EDR Visibility: High — EDR solutions can easily capture service creation, startup folder modifications, and the execution of known third-party tools like AnyDesk, MEGASync, and Everything. Network Visibility: Medium — Network traffic to MEGASync, AnyDesk, and Google Chrome Remote Desktop infrastructure is visible but may blend with legitimate administrative or user traffic. Detection Difficulty: Moderate — Detection relies on identifying the unauthorized installation and use of legitimate third-party tools, which requires a solid baseline of approved applications within the environment.
Required Log Sources
- Event ID 4688 Process Creation
- Event ID 7045 Service Creation
- Event ID 4697 Service Installed
- File System Events
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for unexpected installations or executions of remote access tools (AnyDesk, Chrome Remote Desktop) on servers or endpoints where they are not part of the standard software baseline. | Process Creation (Event ID 4688), Service Creation (Event ID 7045) | Persistence | Medium |
| Hunt for the execution of the 'Everything' file search utility (Everything.exe) followed closely by archiving tools (7z.exe) in rapid succession. | Process Creation (Event ID 4688) | Collection | Low |
| Monitor for MEGASync execution or network connections to MEGA domains from unexpected hosts, indicating potential data exfiltration. | Process Creation (Event ID 4688), Network Connections | Exfiltration | Medium |
Control Gaps
- Lack of application control/allowlisting allowing unauthorized third-party tools to run
- Unrestricted outbound access for file-sharing and remote access services
Key Behavioral Indicators
- Installation of AnyDesk or Chrome Remote Desktop as a service
- Execution of Everything.exe for file discovery
- Presence of .nspire file extensions
- Creation of _nightspire_readme.txt or [nspire_msg].txt
False Positive Assessment
- Medium (Many of the tools used by the threat actor, such as AnyDesk, 7Zip, and Chrome Remote Desktop, are legitimate administrative or user tools and may generate false positives if used legitimately in the environment).
Recommendations
Immediate Mitigation
- Block execution of known NightSpire encryptor hashes.
- Search for and remove unauthorized instances of AnyDesk, Chrome Remote Desktop, and MEGASync across the environment.
- Isolate hosts exhibiting signs of unauthorized remote access tools or unexpected archiving activity.
Infrastructure Hardening
- Implement application allowlisting to prevent the execution of unapproved third-party tools (e.g., Everything, MEGASync, AnyDesk).
- Restrict RDP access to authorized users only and require Multi-Factor Authentication (MFA).
- Block outbound network traffic to known file-sharing and unauthorized remote access domains at the firewall/proxy level.
User Protection
- Deploy and properly configure EDR solutions to monitor for suspicious service creation and startup folder modifications.
- Enforce MFA on all remote access points.
Security Awareness
- Educate IT staff on the risks of unauthorized remote management tools being used as persistence mechanisms by threat actors.
MITRE ATT&CK Mapping
- T1133 - External Remote Services
- T1219 - Remote Access Software
- T1543.003 - Create or Modify System Process: Windows Service
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1083 - File and Directory Discovery
- T1560.001 - Archive Collected Data: Archive via Utility
- T1048 - Exfiltration Over Alternative Protocol
- T1486 - Data Encrypted for Impact
Additional IOCs
- File Paths:
C:\Users\[REDACTED]\Downloads\- Threat actor operations folder observed on March 25, 2026C:\Program Files (x86)\AnyDesk\AnyDesk.exe- Path to AnyDesk executable used for persistenceC:\Program Files (x86)\Google\Chrome Remote Desktop\147.0.7727.3\remoting_host.exe- Path to Chrome Remote Desktop executable used for persistence
- Command Lines:
- Purpose: Establish persistence via AnyDesk service | Tools:
AnyDesk| Stage: Persistence |"C:\Program Files (x86)\AnyDesk\AnyDesk.exe" --service - Purpose: Execute AnyDesk on startup via Common Startup Folder | Tools:
AnyDesk| Stage: Persistence |C:\Program Files (x86)\AnyDesk\AnyDesk.exe --control - Purpose: Establish persistence via Chrome Remote Desktop service | Tools:
Chrome Remote Desktop| Stage: Persistence
- Purpose: Establish persistence via AnyDesk service | Tools:
- Other:
.nspire- Encrypted file extension appended by NightSpire ransomware_nightspire_readme.txt- Ransom note file name (December 2025)[nspire_msg].txt- Ransom note file name (March 2026)
