Spirals: New Stealthy Ransomware Deployed Against Asian IT Company

A new Rust-based ransomware named Spirals was deployed in a double extortion attack against an IT services company in South Asia in June 2026. The attackers gained initial access via a compromised IIS web server and used an ASP.NET web shell to establish persistence, escalate privileges, and move laterally using WMI and PsExec. The ransomware, disguised as bitsadmin.exe, encrypted files using AES-128 keys wrapped with ECDH P-256, and threatened to leak stolen data via a Tor-based portal. Multiple tunneling tools and C2 infrastructure were used to maintain access and exfiltrate data.

AI-extracted · verify before operational use