10 minhigh
Spirals: New Stealthy Ransomware Deployed Against Asian IT Company
A previously unseen Rust-based ransomware family named Spirals was deployed in a double extortion attack against a South Asian IT services company in June 2026. The attackers compromised an internet-facing IIS web server via an ASP.NET web shell, established multiple redundant C2 channels using revsocks, Chisel, and Cloudflare tunnel, performed credential theft via SAM and LSASS dumps, and deployed the ransomware payload via PsExec across the network within 24 hours of initial access. The ransomware uses AES-128 file encryption with ECDH P-256 key wrapping and includes capabilities for defense evasion, lateral movement, and process termination.
Sens:▲ 24h
Showing defanged values
- domainbeta[.]padmin[.]comExternal staging domain used for payload delivery
- domaincomputer[.]kplus[.]comExternal staging domain used for payload delivery
- ip185[.]141[.]216[.]194C2 and staging server used for reverse SOCKS proxy on port 443 and payload delivery
- sha2560f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141Spirals ransomware payload, masquerading as bitsadmin.exe or vbr2116.exe
- sha2564cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649Revsocks reverse SOCKS proxy tool used for covert C2 communication
- sha2567f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134bTunneling tool (tunn.exe) deployed to web production directory and Windows Tasks folder
- sha25683a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892Suspicious file observed during the attack
- sha25684b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22dChisel tunneling tool renamed as chrome.exe for masquerading
- sha256862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1Token impersonation tool used for privilege escalation on compromised host
- sha256b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556Cloudflare tunnel client deployed to web production directory for encrypted outbound C2
- urlhxxp://185[.]141[.]216[.]194/cd[.]jpgPayload staged on C2 server disguised with .jpg extension
- urlhxxp://185[.]141[.]216[.]194/cd[.]zipPayload archive staged on C2 server
- urlhxxps://beta[.]padmin[.]com/mybenefits/Templates/cd[.]zipPayload archive staged on external staging domain disguised under Templates path
- urlhxxps://computer[.]kplus[.]com/cd[.]zipPayload archive staged on external staging domain
![hxxp://185[.]141[.]216[.]194/cd[.]jpg](/iocs/url/http%3A%2F%2F185.141.216.194%2Fcd.jpg){kind=link}
Detection / Hunteropenrouter
What Happened
A new type of malicious software called Spirals ransomware was used to attack an IT company in South Asia in June 2026. The attackers broke in through a vulnerable web server, quickly spread through the company's internal network, stole passwords, and encrypted files while also stealing sensitive data. The entire attack took less than 24 hours from initial break-in to file encryption. The attackers threatened to publish the stolen data if the ransom is not paid within six days. Organizations should check their systems for the specific indicators listed in the report, ensure their web servers are properly secured, verify that their security software cannot be easily disabled, and maintain offline backups that are inaccessible from the main network.
Key Takeaways
- New Rust-based ransomware family 'Spirals' deployed in double extortion attack against South Asian IT company in June 2026
- Attackers moved from initial breach to ransomware deployment in under 24 hours, indicating skilled operators
- Initial access via IIS web server compromise with ASP.NET web shell; multiple redundant C2 channels established using revsocks, Chisel, and Cloudflare tunnel
- Ransomware masquerades as bitsadmin.exe and uses AES-128 encryption with ECDH P-256 key wrapping; deployed via PsExec across domain controllers, file servers, and workstations
- Attackers used defense evasion including uninstalling security tools, disabling Windows Defender, and stopping 23 backup/database/virtualization services before encryption
Affected Systems
- Internet-facing Microsoft IIS web servers
- Windows domain controllers
- Windows file servers
- Windows application servers
- Windows virtual machines
- Windows workstations in enterprise Active Directory environments
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Compromise of internet-facing IIS web server via ASP.NET web shell
- Execution & Persistence: Web shell spawns cmd.exe/powershell.exe; UAC bypass performed, RDP enabled, local account created for persistence
- Credential Access: SAM hive dumped to password-protected archive; LSASS memory dumped via rundll32.exe and comsvcs.dll on multiple machines
- Defense Evasion & C2: Security tools uninstalled via wmic/mpcmdrun.exe; multiple redundant C2 channels established using revsocks, Chisel, and Cloudflare tunnel
- Lateral Movement: WMI-based lateral movement using domain admin accounts to target multiple machines; PsExec used for mass ransomware deployment across domain controllers, file servers, and workstations
- Impact: Spirals ransomware encrypts files with AES-128 keys wrapped using ECDH P-256 public key; double extortion with data leak threat via Tor portal
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. IOCs including SHA256 hashes and network indicators are listed at the end of the article. The article references the Symantec Protection Bulletin for protection updates.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The attackers used masquerading (renaming tools as legitimate binaries) and defense evasion (uninstalling security tools, disabling Defender), which could reduce EDR visibility. However, process execution patterns, file drops, and lateral movement activities should be visible to EDR where it remains installed. |
| Network Visibility | Medium | The attackers used port 443 for C2 (blending with legitimate HTTPS), multiple tunneling tools, and Cloudflare tunnels, making network detection challenging. However, the staging URLs and IP are identifiable through DNS and proxy logs. |
| Detection Difficulty | Moderate | The attackers used legitimate admin tools (PsExec, WMI, PowerShell) and masquerading techniques, which can blend with normal admin activity. However, the combination of activities, rapid execution timeline, and specific IOCs provide multiple detection opportunities. |
Required Log Sources
- EDR process execution telemetry
- EDR file creation events
- Windows Security Event Log (Event ID 4688 - Process Creation)
- PowerShell Script Block Logging (Event ID 4104)
- Windows System Event Log (Event ID 7036 - Service Stop)
- IIS W3SVC logs
- DNS resolution logs
- Network flow data
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for IIS worker process spawning command-line interpreters, which may indicate web shell activity (T1505.003, T1059) | EDR process telemetry showing parent-child process relationships, IIS W3SVC logs | Initial Access / Execution | Low-Medium - legitimate web applications may spawn command-line processes, but this is uncommon in production environments |
| Consider hunting for multiple tunneling or proxy tools deployed from web directories or Windows Tasks folder, which may indicate establishment of redundant C2 channels (T1090) | EDR file creation events and process execution logs | Command and Control | Low - legitimate tunneling tools are rarely deployed in web production directories or Tasks folder |
| Consider hunting for PsExec executing encoded PowerShell payloads across many hosts in rapid succession, which may indicate automated ransomware deployment (T1021.002, T1059.001) | EDR process execution logs, PowerShell Script Block Logging (Event ID 4104) | Lateral Movement / Execution | Medium - PsExec is a legitimate admin tool, but mass deployment with encoded payloads across many hosts in seconds is suspicious |
| Consider hunting for LSASS memory dump activity via rundll32 loading comsvcs.dll, which may indicate credential harvesting (T1003.001, T1218.011) | EDR process telemetry showing rundll32.exe with comsvcs.dll, Windows Security Event Log | Credential Access | Low - this technique is almost exclusively used for credential theft |
| Consider hunting for bulk service stopping commands targeting backup, database, and virtualization services, which is a common pre-encryption ransomware activity (T1490) | EDR process execution logs, PowerShell Script Block Logging, Windows System Event Log | Impact Preparation | Medium - legitimate administrators may stop services for maintenance, but bulk stopping of backup and database services is unusual |
Control Gaps
- Signature-based antivirus may not detect the new Rust-based ransomware payload
- Network firewalls may not detect C2 traffic over port 443 using legitimate tunneling tools
- If endpoint security tools are successfully uninstalled, EDR visibility is lost on affected hosts
- Application control policies may allow legitimate admin tools (PsExec, WMI) used for lateral movement
- File integrity monitoring may not cover web production directories where tools are staged
Key Behavioral Indicators
- IIS worker process (w3wp.exe) spawning cmd.exe or powershell.exe as child processes
- Executables with legitimate Windows binary names (e.g., bitsadmin.exe, chrome.exe) in atypical locations such as Windows Tasks folder or web directories
- MpCmdRun.exe being invoked with flags to disable real-time monitoring
- Multiple tunneling or proxy tools deployed from web production directories within a short time window
- PsExec executing encoded PowerShell payloads across many hosts in rapid succession
- rundll32.exe loading comsvcs.dll, indicating potential LSASS memory dump activity
- Executable files created in SYSVOL domain scripts directory
- Ransom note file with .log extension written to drive root
False Positive Assessment
Low - Specific IOCs (SHA256 hashes, IP addresses, staging URLs) have low false positive risk. Behavioral indicators involving legitimate admin tools (PsExec, WMI, PowerShell) may generate false positives in environments where these tools are used routinely for administration.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Search endpoint and network telemetry for the IOCs listed in this report, particularly the SHA256 hashes, staging IP address, and staging URLs.
- If your EDR supports host isolation, consider isolating any machines matching the file hashes or communicating with the known staging infrastructure.
- Check internet-facing IIS web servers for unauthorized ASP.NET web shells and review IIS logs for command-line interpreter processes spawned by the IIS worker process.
Infrastructure Hardening
- Evaluate whether internet-facing IIS servers need to be directly exposed; consider placing them behind a WAF or reverse proxy if not already implemented.
- Review and restrict write permissions to web production directories to prevent web shell upload.
- Consider implementing network segmentation to limit lateral movement between servers and workstations.
- Evaluate whether PsExec and WMI remote execution are necessary in your environment; if so, consider restricting their use to specific administrative workstations.
User Protection
- Ensure EDR agents are deployed across all endpoints and servers, including domain controllers and file servers.
- Consider enabling tamper protection on endpoint security products to prevent unauthorized uninstallation.
- Verify that Windows Defender tamper protection is enabled to prevent disabling via command-line tools.
- Ensure backups are stored offline or in isolated network segments inaccessible from production systems.
Security Awareness
- Consider incorporating web shell detection and response procedures into existing security operations training programs.
- If applicable to your organization's awareness program, educate IT staff on the risks of exposing IIS servers and the importance of timely patching.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping18 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Credential Access
Tactic
Lateral Movement
Tactic
Command and Control
Additional IOCs
- Domains:
computer[.]kplus[.]com- External staging domain used for payload deliverybeta[.]padmin[.]com- External staging domain used for payload delivery
- File Hashes:
7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b(SHA256) - Tunneling tool (tunn.exe) deployed to web production directory and Windows Tasks folder83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892(SHA256) - Suspicious file observed during the attack
- File Paths:
C:\RECOVERY_SECTION.log- Ransom note location written by Spirals ransomwareCSIDL_PROFILE\public\tunn.exe- Tunneling tool placed in public web production directoryCSIDL_WINDOWS\tasks\tunn.exe- Tunneling tool placed in Windows Tasks folder for masqueradingCSIDL_WINDOWS\tasks\chrome.exe- Chisel tunneling tool renamed as chrome.exe in Windows Tasks folderCSIDL_DRIVE_FIXED\webprodprojects\wicapfiles\cloudflared-windows-amd64.exe- Cloudflare tunnel client deployed to web production directoryCSIDL_WINDOWS\bitsadmin.exe- Spirals ransomware payload masquerading as Windows bitsadmin.exe utilityCSIDL_PROFILE\desktop\bitsadmin.exe- Spirals ransomware payload placed on desktopCSIDL_WINDOWS\sysvol_dfsr\domain\scripts\bitsadmin.exe- Spirals ransomware payload placed in SYSVOL domain scripts for domain-wide replicationCSIDL_PROFILE\appdata\local\temp\vbr2116.exe- Renamed Spirals ransomware executable in Temp directory, dropped by process masquerading as svchost.exe
- Command Lines:
- Purpose: Mass deployment of base64-encoded PowerShell payload to remote machines via PsExec for ransomware distribution | Tools:
psexec.exe,powershell.exe| Stage: Lateral Movement |psexec.exe -accepteula -d -s \\<target> powershell -nop -w 1 -enc - Purpose: Disable Windows Defender real-time monitoring and remove threat definitions before ransomware deployment | Tools:
MpCmdRun.exe,powershell.exe| Stage: Defense Evasion |MpCmdRun.exe -RemoveDefinitions -All -DisableRealtimeMonitoring - Purpose: Enumerate and forcibly stop backup, database, and virtualization services to prevent interference with file encryption | Tools:
powershell.exe| Stage: Impact Preparation |Stop-Service -Name <servicename> -Force - Purpose: Dump LSASS process memory for credential harvesting during WMI-based lateral movement | Tools:
rundll32.exe,comsvcs.dll| Stage: Credential Access |rundll32.exe comsvcs.dll
- Purpose: Mass deployment of base64-encoded PowerShell payload to remote machines via PsExec for ransomware distribution | Tools: