AttackIQ Releases NightSpire Ransomware Emulation for Defense Testing

Apr 17, 2026 · Original article ↗

Summary

AttackIQ released an emulation based on internal analysis of NightSpire samples, covering host discovery and file encryption to help organizations test security controls. The article also describes the group’s reported tactics and ransomware behavior.

Key points

The emulation models NightSpire behaviors, including system profiling, reconnaissance, and file encryption, to help teams test detection and prevention controls.
It covers discovery using Windows APIs and registry queries, including retrieval of the system’s MachineGUID.
The article describes NightSpire’s Go payload as using AES-256 CBC and RSA-2048, with partial encryption of some large files and full encryption of smaller files; encrypted files receive the .nspire extension.
The article reports phishing and exploitation of exposed services, including observed abuse of CVE-2024-55591 in FortiOS appliances, as initial access methods.
NightSpire is described as a financially motivated extortion group that has announced a shift from an operator-run model to a ransomware-as-a-service program.
AttackIQ recommends supplementing the emulation with scenarios for obfuscated Mimikatz credential dumping and lateral movement using PAExec or WMI.

Article Details

Defense Focus: Validate detection and prevention controls and incident-response readiness against NightSpire ransomware behaviors.
Detection Methods: Use the AttackIQ emulation to test detection and prevention of NightSpire sample delivery and execution.
Monitor for the described host, user, registry, network, process, service, drive, volume, and file-system discovery behaviors.
Test detection of file encryption and the addition of the .nspire extension.
Use the recommended Mimikatz, PAExec, and WMI scenarios to assess coverage for credential dumping and lateral movement.
Data Sources: Endpoint telemetry for the described Windows API calls, including system and user discovery, process and service enumeration, drive and volume discovery, and file-system traversal.
Registry activity involving the MachineGUID entry under HKLM\SOFTWARE\Microsoft\Cryptography.
Telemetry for sample downloads and writes to disk.
File activity showing encryption and the .nspire extension.
Platforms: AttackIQ Adversarial Exposure Validation (AEV) Platform
Defensive Actions: Run the NightSpire emulation to evaluate security controls against the described behaviors.
Test both network and endpoint controls against delivery of the identified samples.
Use the recommended Mimikatz, PAExec, and WMI emulation scenarios to assess additional detection and prevention coverage.
Use results from continuous testing to adjust controls and improve incident-response readiness.

Indicators of compromise

Type	Indicator	Context
SHA256	`8f58870a3e5df1d904940c7ef2ad160b90ba739c7e5e21e4c908945e0a6f3f60`	SHA-256 listed in the article among NightSpire ransomware sample hashes.
SHA256	`c5f526cc62688cf34c49d098dab81e24e4294f832ada57433ef505d5ac6da8f3`	SHA-256 identified in the article for a NightSpire ransomware sample used in the emulation.