NightSpire Ransomware Uses Remote-Access Tools and Cloud Exfiltration in Double-Extortion Attacks
Summary
The article describes NightSpire’s use of remote-access tools, file discovery and archiving utilities, and MEGAsync for data theft before encryption. Its Go encryptor appends .nspire, while ransom notes also claim OneDrive files were encrypted.
Key points
- The article reports that NightSpire used double extortion, stealing data before encryption and threatening to publish it on a Tor-based leak site.
- It says NightSpire affected at least 64 organizations in 33 countries between March and June 2025; separately, it describes a March 2026 intrusion.
- In the described intrusion, access was obtained over RDP; Chrome Remote Desktop and AnyDesk were used to maintain access through services and, for AnyDesk, a Startup-folder shortcut.
- Everything was used to find files, 7-Zip to archive selected data, and MEGAsync to transfer staged archives to MEGA cloud storage.
- The Go-based encryptor enumerates accessible drives, appends .nspire to encrypted files, and places a ransom note in affected folders.
- The ransom note claimed that OneDrive files were also locked, but their extensions were not changed. The article does not provide independent confirmation of that claim.
- Picus promotes its security validation platform and lists two NightSpire threat simulations in its threat library.
Article Details
- Attack Vectors
- In a March 2026 intrusion, the threat actor reached an endpoint over Remote Desktop Protocol (RDP).
- Chrome Remote Desktop and AnyDesk were installed on compromised machines to maintain remote access; AnyDesk also used a Startup-folder shortcut for auto-start.
- Everything was used to find files, 7-Zip to archive selected folders, and MEGAsync to upload archives to MEGA cloud storage.
- The NightSpire Go executable enumerated accessible drives and directories, encrypted files, and appended the .nspire extension. The article also reports encryption of OneDrive files.
- Defensive Notes
- Picus recommends simulating NightSpire attacks to test security controls; the article does not provide specific detection or remediation steps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
prince1990905@gmail[.]com | Google account associated with the Chrome Remote Desktop deployment on compromised machines. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe article reports that the threat actor reached an endpoint over Remote Desktop Protocol (RDP).T1074.001 · Local Data StagingSelected files were staged in 7-Zip archives in a Downloads folder before upload.T1083 · File and Directory DiscoveryEverything was used to search drives for files, and the encryptor enumerated accessible directories and drives.T1219 · Remote Access ToolsThe threat actor used Chrome Remote Desktop and AnyDesk to maintain remote access and stealth.T1486 · Data Encrypted for ImpactThe NightSpire encryptor encrypted accessible files and appended the .nspire extension.T1543.003 · Windows ServiceChrome Remote Desktop and AnyDesk were configured as Windows services on compromised machines.T1547.001 · Registry Run Keys / Startup FolderAn AnyDesk shortcut was placed in the Startup folder to enable auto-start at boot.T1560.001 · Archive via Utility7-Zip was used to compress selected folders into archives before transfer.T1567.002 · Exfiltration to Cloud StorageMEGAsync was used to upload staged archives to MEGA cloud storage.
Malware
Products
Tools
7-ZipBetween March and June 2025, it hit at least 64 organizations in 33 countries, using tools like Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, and MEGAsync to stay stealthy and exfiltrate data.AnyDeskBetween March and June 2025, it hit at least 64 organizations in 33 countries, using tools like Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, and MEGAsync to stay stealthy and exfiltrate data.Chrome Remote DesktopBetween March and June 2025, it hit at least 64 organizations in 33 countries, using tools like Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, and MEGAsync to stay stealthy and exfiltrate data.EverythingBetween March and June 2025, it hit at least 64 organizations in 33 countries, using tools like Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, and MEGAsync to stay stealthy and exfiltrate data.MEGAsyncBetween March and June 2025, it hit at least 64 organizations in 33 countries, using tools like Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, and MEGAsync to stay stealthy and exfiltrate data.
Countries
Egyptleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.Hong Kongleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.Japanleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.Mexicoleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.Spainleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.Taiwanleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.Turkeyleading the victim list, followed by Turkey, Hong Kong, Japan, Taiwan, Mexico, Spain, and Egypt.United StatesBetween March and June 2025, NightSpire hit at least 64 organizations across 33 countries, with the U.S.
Industries
EducationThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.financeThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.HealthcareThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.HospitalityThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.IT servicesThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.logisticsThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.ManufacturingThe attacks target a broad array of industries, from healthcare, education, and governmental institutions, to finance, manufacturing, hospitality, IT services, and logistics.