New Spirals Ransomware Used in Double-Extortion Attack on South Asian IT Company

Jul 16, 2026 · Original article ↗

Summary

A previously unseen Rust-based ransomware called Spirals was deployed against a South Asian IT company in June 2026 after attackers compromised an internet-facing IIS server. The actor is unknown; the attack involved data-theft threats and file encryption.

Key points

Attackers gained access through an internet-facing IIS server using an ASP.NET web shell; ransomware deployment began less than 24 hours later.
They established persistence, disabled security tools, stole credentials from the SAM hive and LSASS memory, and used tunneling tools for covert remote access.
WMI and PsExec enabled rapid lateral movement and ransomware deployment across domain controllers, servers, virtual machines, and workstations.
The attackers disabled Windows Defender and stopped services associated with backup, database, and virtualization products before encryption.
The Rust-based payload encrypted files using per-file AES-128 keys wrapped with an attacker-controlled ECDH P-256 key; large files were encrypted in intermittent chunks.
The ransom note threatened to publish stolen data after six days, indicating double extortion. The actor remains unknown, and the report has observed Spirals on one victim network.

Article Details

Attack Vectors: Initial access through a compromised internet-facing web server and an uploaded ASP.NET web shell; the server compromise method was not disclosed.
Interactive command execution through the web shell, followed by a UAC bypass, local account creation, and enablement of remote desktop access.
Credential harvesting from the SAM hive and LSASS process memory, followed by lateral movement using abused accounts.
Redundant reverse-proxy and tunneling channels maintained external connectivity; additional payloads were downloaded from an external IP and two staging domains.
Remote deployment as SYSTEM, with additional ransomware copies placed in domain scripts directories and a domain-controller-hosted network share.
File encryption accompanied by a ransom-note threat to publish stolen data after six days if payment was not made.
Defensive Notes: The article directs readers to the Symantec Protection Bulletin for the latest protection updates.

Indicators of compromise

Type	Indicator	Context
IPV4	`185[.]141[.]216[.]194`	External attack infrastructure listed as a network IOC; the article describes an external IP used for reverse-SOCKS connectivity and payload delivery.
SHA256	`0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141`	Spirals ransomware deployed as bitsadmin.exe and vbr2116.exe.
SHA256	`4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649`	Revsocks reverse-SOCKS proxy deployed and executed by the attackers as revsocks.exe.
SHA256	`7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b`	Attacker-deployed tunneling utility named tunn.exe.
SHA256	`83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892`	File explicitly identified as suspicious in the article's IOC list.
SHA256	`84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d`	Attacker-deployed Chisel tunneling tool renamed chrome.exe.
SHA256	`862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1`	Token impersonation tool executed by the attackers as tokens.exe.
SHA256	`b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556`	Attacker-deployed Cloudflared binary named cloudflared-windows-amd64.exe.
URL	`hxxp[:]//185[.]141[.]216[.]194/cd[.]jpg`	Payload or tool staging URL listed as a network IOC; attackers disguised some delivered files with .jpg extensions.
URL	`hxxp[:]//185[.]141[.]216[.]194/cd[.]zip`	Payload or tool staging URL on the external attack infrastructure.
URL	`hxxps[:]//beta[.]padmin[.]com/mybenefits/Templates/cd[.]zip`	External payload or tool staging URL listed as a network IOC.
URL	`hxxps[:]//computer[.]kplus[.]com/cd[.]zip`	External payload or tool staging URL listed as a network IOC.