Do Son 
At a glance
| Malware family | Spirals (new Rust-based ransomware, named by its operators) |
| Threat actor | Unknown. No named group; attribution not established. |
| Target / victims | One IT services company in South Asia; one case observed so far |
| Delivery vector | Compromised internet-facing IIS server via an ASP.NET web shell |
| Key capabilities | Rust file encryption, defense evasion, lateral movement, privilege escalation, double extortion |
| Source | Symantec Threat Hunter Team (Symantec and Carbon Black) |
TL;DR
Symantec disclosed a new Rust-based family called Spirals ransomware on July 16, 2026. Attackers hit a South Asian IT services firm and encrypted its network in under 24 hours. The case shows a fast, skilled operator using a double extortion model.
Why it matters
Speed is the headline here. The operators went from first breach to mass encryption in less than a day. Symantec warns the skill on display could fuel wider campaigns. As the team puts it, the actors are “skilled operators who could easily launch more wide-ranging campaigns.”
Delivery
The intrusion started at the edge. Attackers compromised an internet-facing IIS web server and uploaded an ASP.NET web shell. That shell let them spawn cmd.exe and PowerShell through the IIS worker process. A hands-on-keyboard session followed.
Infection chain
The early moves were textbook and quick. Within a three-hour session, the operator escalated privileges through a UAC bypass. Next, they enabled RDP and created a local account for persistence.
Credential theft came next. The attackers dumped the SAM hive into a password-protected archive. Later, they dumped LSASS memory on several machines using living-off-the-land binaries.
Lateral movement and deployment
Movement began the same night over WMI. More than a dozen machines were hit within minutes, which points to automated spreading. The pace suggests the attackers had already built a target list from Active Directory.
The next day, they switched to PsExec running as SYSTEM. A base64-encoded PowerShell payload went out to machine after machine. It first disabled Windows Defender, then killed 23 backup, database, and virtualization services so files sat unlocked for encryption.
How Spirals encrypts
The payload masqueraded as bitsadmin.exe, a real Windows tool. Symantec describes Spirals as “a full-featured file-encrypting ransomware written in Rust.” Each file gets its own AES-128 key. That key is then wrapped with an attacker-controlled ECDH P-256 public key. Files over 5 MB use intermittent encryption to run faster.
Command-and-control and exfiltration
The operators built redundant covert channels. They ran a reverse-SOCKS proxy to an external IP on port 443. They also renamed a Cloudflare tunnel binary to expose RDP outward, and deployed the Chisel tool disguised as chrome.exe.
Tools arrived from one external IP and two staging domains. In some cases, the files wore .jpg extensions as a disguise. This double extortion campaign then leaned on stolen data for pressure.
The extortion play
Spirals dropped a ransom note at C:\RECOVERY_SECTION.log. The note threatens to publish stolen data after six days without payment. It directs victims to a Tor portal, and an onion site carries the Spirals name. That combination confirms a classic double extortion scheme.
Detection and defense guidance
Focus on the edge and the behavior. Patch and monitor internet-facing IIS servers, and hunt for new web shells. Watch for Defender being disabled and backup services stopping at scale.
Other strong signals include SAM and LSASS dumping, plus PsExec pushing encoded PowerShell across many hosts. Symantec published file and network indicators, so defenders can hunt for the tunneling tools and staging infrastructure today.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
