Symantec Details Spirals Ransomware Intrusion That Encrypted Network in Under 24 Hours
Summary
Symantec describes Spirals ransomware compromising a South Asian IT services firm through an exposed IIS server, then stealing data and encrypting systems in under 24 hours. The actor was observed in one case.
Key points
- Symantec says Spirals gained access through an exposed IIS server and uploaded an ASP.NET web shell.
- The operator used UAC bypass, enabled RDP, created a local account, and attempted to dump credentials.
- WMI, revsocks, Chisel, and Cloudflare tunnels supported lateral movement and remote access.
- A PowerShell payload disabled Microsoft Defender and stopped services tied to backup, database, and virtualization products.
- The ransomware payload, named bitsadmin.exe, was deployed with PsExec less than 24 hours after initial compromise.
- Spirals is Rust-based, uses AES-128 with keys protected by an attacker-controlled ECDH P-256 public key, and intermittently encrypts files larger than 5 MB.
- Symantec observed Spirals in one case and provided network indicators and file hashes to help defenders detect the threat.
Article Details
- Attack Vectors
- Compromise of an Internet-exposed IIS server, followed by upload of an ASP.NET web shell.
- UAC bypass and local account creation to maintain access; Remote Desktop was enabled.
- SAM registry hive and LSASS memory were dumped in an attempt to obtain credentials.
- WMI was used for lateral movement, while revsocks, Chisel, and Cloudflare tunnels provided remote access channels.
- A PowerShell payload disabled Microsoft Defender and stopped services associated with backup, database, and virtualization products.
- PsExec running as SYSTEM was used to deploy the ransomware payload across the victim network; files were encrypted and stolen data was threatened with public release.
- Defensive Notes
- Review public-facing IIS servers for unauthorized ASP.NET web shells and investigate rapid follow-on activity.
- Monitor for UAC bypass, unexpected local account creation, and access to the SAM hive or LSASS memory.
- Alert on attempts to disable Microsoft Defender, remove its threat definitions, or stop backup, database, and virtualization services.
- Investigate WMI lateral movement, unexpected PsExec execution, and remote-access tunnels involving revsocks, Chisel, or Cloudflare tunnels.
MITRE ATT&CK
T1003.001 · LSASS MemoryThe operator dumped LSASS process memory in an attempt to extract credentials.T1003.002 · Security Account ManagerThe operator dumped the SAM registry hive in an attempt to extract credentials.T1047 · Windows Management InstrumentationWMI was used to move laterally to more than a dozen systems.T1059.001 · PowerShellA PowerShell payload disabled Microsoft Defender, removed its threat definitions, and stopped services.T1136.001 · Local AccountThe operator created a local account to maintain persistent access.T1486 · Data Encrypted for ImpactThe Spirals payload encrypted files on impacted machines, using intermittent encryption for files larger than 5 MB.T1490 · Inhibit System RecoveryServices associated with backup products were stopped before encryption.T1505.003 · Web ShellThe attacker uploaded an ASP.NET web shell to the compromised public-facing IIS server.T1548.002 · Bypass User Account ControlThe Spirals operator bypassed User Account Control to maintain access.T1562.001 · Disable or Modify ToolsThe attacker attempted to remove security software and used a PowerShell payload to disable Microsoft Defender and remove its threat definitions.T1569.002 · Service ExecutionPsExec running as SYSTEM was used to deploy the ransomware payload across the victim network.T1572 · Protocol TunnelingThe attacker established remote access channels using revsocks, Chisel, and Cloudflare tunnels.
Threat Actors
Malware
Vendors
Products
IISSpirals, a new ransomware actor, completed a full intrusion against an IT services firm in South Asia in less than 24 hours, stealing data and encrypting systems after compromising an exposed IIS server.Microsoft Defender Antimalware PlatformThe ransomware disabled Microsoft Defender and targeted backup, database, and virtualization services before encryption.Microsoft Hyper-Vservices associated with 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage.Oraclewith 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage.PostgreSQLdatabase, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage.SQL Serverassociated with 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage.Veeamand stopped services associated with 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage.VMwareand stopped services associated with 23 backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL, in preparation for the encryption stage.