Huntress Finds NightSpire Ransomware Tactics Vary Across Attacks
Summary
Huntress compares two NightSpire ransomware incidents, detailing RDP access and attacker tools used for persistence, file collection and likely exfiltration. Different tactics and ransom-note files leave NightSpire’s RaaS status uncertain.
Key points
- In a March 2026 incident, the threat actor accessed an endpoint over RDP before Huntress installed its agent.
- The actor used Chrome Remote Desktop and AnyDesk for footholds, Everything and 7Zip for file discovery and archiving, and MEGASync, likely for data exfiltration.
- Huntress observed the actor viewing files, but could not validate the ransom note’s claim that 2.5TB of data was taken or determine what files were taken.
- Compared with a December 2025 incident, the March incident had different tooling and ransom-note details; Huntress says the encryptor appears to have changed.
- Huntress says the differences could reflect changes to NightSpire or variation among affiliates; whether NightSpire operates as a RaaS remains unclear.
- The article cautions that indicators and tactics attributed to a ransomware group can vary substantially between attacks.
Article Details
- Attack Vectors
- An attacker accessed an endpoint via RDP several days before Huntress monitoring was installed.
- The attacker installed Chrome Remoting Desktop and AnyDesk as foothold or persistence mechanisms.
- The attacker used Everything to locate and access files, then 7Zip to archive files from a specific folder.
- MEGASync was run, likely for data exfiltration; Huntress could not validate the ransom note's claim that 2.5 TB was taken.
- NightSpire ransomware was launched on an endpoint. The article says publicly reported attacks have also used WMI or PsExec, but these were not observed in the investigated incident.
- Defensive Notes
- Investigate each ransomware incident on its own evidence; tools, indicators, and tactics can vary between attacks bearing the same ransomware name, potentially because of affiliate activity or changes to the operation.
- Monitor for unexpected remote-access and file-management tools, including Chrome Remoting Desktop, AnyDesk, Everything, 7Zip, MEGASync, VMWare Workstation, and WPS Office, especially when they are newly downloaded to endpoints.
- Correlate process lineage and endpoint activity to identify file access, staging, and archive creation; do not treat ransom-note claims about stolen data as confirmed without corroborating evidence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
prince1990905@gmail[.]com | Email address associated with Chrome Remoting Desktop during the March 24 and 25, 2026 incident. | |
| SHA256 | ad67031e2ca68764fe1a7d6632c02b02a299d59efb920710011a9a2ccf4399b7 | SHA-256 hash identified as the NightSpire file encryptor enc.exe from March 25, 2026. |
| SHA256 | bde50a42efc079edde1a314243ad339db2d42e343fbbcd39117803b0f5960355 | SHA-256 hash identified as the NightSpire file encryptor enc.exe from the December 2, 2025 incident. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe threat actor accessed an endpoint via RDP several days before the Huntress agent was installed.T1059.001 · PowerShellThe article describes the Akira file encryptor launching a PowerShell child process to delete available Volume Shadow Copies.T1486 · Data Encrypted for ImpactNightSpire ransomware was launched on an endpoint and encrypted files, which had the .nspire extension in the earlier incident.T1490 · Inhibit System RecoveryThe Akira file encryptor's PowerShell command deleted available Volume Shadow Copies, inhibiting recovery.T1560.001 · Archive via UtilityThe threat actor used 7Zip to archive files from a specific folder.T1567.002 · Exfiltration to Cloud StorageMEGASync was run and was assessed as likely being used for data exfiltration.
People
Malware
AkiraNews articles will frequently feature splashy headlines like “Akira ransomware group targets critical infrastructure.” However, the reality is that Akira, and many other ransomware variants, are distributed via anNightSpireHomeBlogLeveling Up with NightSpire RansomwareSodinokibiIn 2020, Sodinokibi samples were found to include 156 unique embedded commands to terminate processes and services associated with anti-virus products.
Products
7ZipThe threat actor could then be seen running 7Zip to archive files from a specific folder.AnyDeskOn a second endpoint within the infrastructure, as illustrated in Figure 2, foothold signals for Chrome Remoting Desktop and AnyDesk were generated shortly after the Huntress agent was installed.Chrome Remoting Desktopone endpoint via RDP several days prior to the Huntress agent being installed, and had installed Chrome Remoting Desktop, followed by Everything, a file search tool freely available from voidtools.Everythingprior to the Huntress agent being installed, and had installed Chrome Remoting Desktop, followed by Everything, a file search tool freely available from voidtools.MEGASyncTwo days later, the threat actor could be seen running MEGASync, likely for data exfiltration, and then installing VMWare Workstation on the endpoint, and then running Everything, from which the threat actor could thenVMWare Workstationthe threat actor could be seen running MEGASync, likely for data exfiltration, and then installing VMWare Workstation on the endpoint, and then running Everything, from which the threat actor could then be seen, basedWPS OfficeThe following day, the threat actor was observed installing WPS Office, a multi-platform office suite freely available from the Chinese company Kindsoft Office Software.