# Spirals Ransomware Hits South Asia in 24-Hour Blitz: New Rust-Based Threat Disables Defenses at Lightning Speed


A newly identified ransomware actor known as Spirals has demonstrated alarming operational efficiency, compromising an IT services firm in South Asia and encrypting its entire network infrastructure in less than 24 hours. The attack, analyzed by Symantec's Threat Hunter Team and documented in July 2026, reveals a sophisticated threat actor moving with precision from initial network access to full data exfiltration and encryption deployment—a speed that underscores the critical need for rapid threat detection and response capabilities across enterprise environments.


## The Threat


The Spirals attack unfolded with the kind of orchestrated precision that suggests either a highly experienced threat actor or a well-resourced criminal operation. After gaining initial access through an exposed Internet Information Services (IIS) web server, the attacker moved through the victim's environment with minimal delay, establishing persistence, moving laterally to more than a dozen systems, and ultimately deploying a custom Rust-based ransomware payload that locked down the organization's assets.


What distinguishes this incident is not merely the speed of execution, but the methodical dismantling of the victim's defensive layers. Before launching encryption, the attacker:


  • Disabled critical security software including Microsoft Defender
  • Removed threat definitions from security tools
  • Halted 23 backup, database, and virtualization services, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL
  • Established multiple redundant remote access channels to ensure persistence even if one path was discovered

    • These preparatory steps suggest the attacker understood that attacking the infrastructure—not just the data—was essential to preventing recovery.


    ## Background and Context


    The victim organization was an IT services firm operating in South Asia, a region that serves as a critical hub for global outsourced IT operations, managed services, and software development. The initial compromise occurred through a classical attack vector: an Internet-facing IIS server without adequate segmentation or detection controls.


    An ASP.NET web shell provided the attacker's foothold. From that single exposed endpoint, the threat actor executed a cascade of privilege escalation and lateral movement techniques designed to convert initial access into network-wide compromise:


    | Attack Phase | Actions Taken | Timeline |

    |---|---|---|

    | Initial Access | Compromised exposed IIS server, uploaded ASP.NET web shell | Hour 0 |

    | Privilege Escalation | Bypassed User Account Control (UAC), dumped SAM and LSASS | Hours 1-4 |

    | Persistence | Enabled Remote Desktop Protocol (RDP), created local administrative account | Hours 2-6 |

    | Lateral Movement | Used WMI to move to 12+ systems, deployed revsocks, Chisel, and Cloudflare tunnels | Hours 6-18 |

    | Defense Evasion | Disabled Defender, removed threat definitions, stopped backup and database services | Hours 18-23 |

    | Encryption Deployment | Distributed Spirals payload via PsExec running as SYSTEM | Hour 24 |


    The speed of this operation—24 hours from initial access to enterprise-wide encryption—reflects both the attacker's operational maturity and potential gaps in the victim's detection infrastructure. Security teams typically log only 54% of successful attacks and alert on just 14%, meaning the vast majority of attacker activity can move through a network undetected.


    ## Technical Details


    ### The Spirals Ransomware


    Spirals is a Rust-based ransomware family that employs sophisticated cryptographic techniques to render victim data inaccessible. Key technical characteristics include:


  • Encryption Algorithm: AES-128 symmetric encryption with keys protected by an attacker-controlled ECDH P-256 public key
  • Optimization Technique: Intermittent (sparse) encryption for files larger than 5MB, dramatically accelerating the encryption phase while maintaining the inability to recover data without the attacker's private key
  • Execution Method: Deployed and executed via PsExec running as SYSTEM, giving the payload maximum privileges across victim machines
  • Payload Masquerading: Named bitsadmin.exe to impersonate the legitimate Windows Background Intelligent Transfer Service utility

    • ### Attack Infrastructure and Tools


    The attacker leveraged a combination of legitimate Windows utilities and specialized tunneling infrastructure:


  • WMI (Windows Management Instrumentation): Used for lateral movement without creating obvious network traffic signatures
  • PsExec: Deployed ransomware payloads across compromised systems with SYSTEM-level privileges
  • revsocks and Chisel: Specialized reverse proxy and tunneling tools providing redundant command-and-control channels
  • Cloudflare Tunnels: Used to obscure the attacker's actual command infrastructure behind Cloudflare's legitimate services, complicating attribution and takedown efforts

    • This combination of techniques—mixing legitimate administrative tools with specialized tunneling—represents a mature approach to hiding attacker activity from network monitoring and forensic analysis.


    ### Ransom Demands and Extortion


    Upon encryption completion, the attacker dropped a ransom note named RECOVERY_SECTION.log on the C:\ drive containing instructions for ransom negotiation. The threat actor demanded payment within six days, threatening to publicly expose stolen data if demands were not met—a double-extortion model that has become standard in the ransomware ecosystem.


    ## Implications


    ### Attack Speed as a Systemic Risk


    The sub-24-hour timeline from initial access to full encryption represents a significant shift in ransomware operations. Traditional attacks required days or weeks of reconnaissance and staging. Modern campaigns compress that timeline, exploiting the gap between detection and response. Organizations with detection and response capabilities designed for hours-long response windows may find those assumptions invalidated by attackers operating at this tempo.


    ### Targeting of IT Services Firms


    The selection of an IT services provider as the victim is noteworthy. These organizations typically:


  • Maintain extensive network infrastructure with multiple customer connections
  • Hold credentials and access tokens for numerous client environments
  • Store sensitive configuration details, intellectual property, and service documentation
  • Operate in competitive markets where rapid recovery pressure is high

    • A compromise of an IT services firm creates ripple effects across multiple downstream customers, amplifying the attacker's leverage for ransom demands and creating cascading security incidents.


    ### Limited Observation Window


    To date, Spirals has been observed in only one documented case. This raises critical questions about the threat's nature:


  • Is Spirals a custom payload created specifically for this attack, suggesting the attacker may have been contracted by a competitor or motivated actor?
  • Is it an emerging ransomware-as-a-service (RaaS) offering with limited distribution so far?
  • Has the attacker been selective about targets, or does limited observation simply reflect detection and reporting gaps in the broader threat landscape?

    • ## Recommendations


    ### For Organizations with Internet-Facing Systems


    1. Inventory and Segment: Maintain current inventory of all internet-facing systems. Implement network segmentation so that compromise of a single external system does not provide lateral movement to critical assets.


    2. Rapid Patching Cadence: IIS servers represent a known attack vector. Establish and maintain a rapid patching program for web server software, prioritizing critical and high-severity vulnerabilities.


    3. Web Shell Detection: Implement behavioral detection for ASP.NET web shell activity, including unusual HTTP POST patterns, child process spawning from IIS worker processes, and suspicious file creation in web directories.


    ### For Security Operations


    1. Reduce Detection-to-Response Gap: The 24-hour window in this attack would have triggered few alerts in typical environments. Implement real-time alerting for UAC bypass attempts, LSASS memory access, and service disablement, particularly around backup and security products.


    2. Credential Dumping as an Indicator: Monitor for SAM registry access and LSASS process memory access, which preceded lateral movement. These actions are unusual in normal business operations.


    3. Backup Isolation: Implement offline, immutable backups separate from production networks. The attacker's systematic disabling of backup services suggests that backup infrastructure was accessible from compromised systems—a configuration gap that should be remediated.


    ### For Infrastructure Teams


    1. Immutable Backup Strategy: Adopt 3-2-1-1 backup protocols: 3 copies of data, 2 different storage media, 1 offsite location, 1 immutable/offline copy. The attacker's ability to disable 23 backup and virtualization services suggests they were networked and discoverable.


    2. Service Disable Prevention: Use Group Policy, AppLocker, and endpoint detection and response (EDR) tools to prevent the disabling of critical services like backup software, database services, and hypervisors.


    3. Remote Access Hardening: Restrict RDP and SSH access to bastion hosts with multi-factor authentication; do not permit direct RDP access from compromised systems.


    ---


    ## HackWire Analysis


    The Spirals attack reveals a critical trend in modern ransomware operations: the convergence of speed, infrastructure targeting, and defense evasion. The attacker's systematic disabling of 23 backup and database products wasn't incidental—it reflects a deliberate strategy to eliminate the most common path to recovery without paying a ransom. This is a meaningful escalation beyond earlier ransomware families that simply encrypted data and hoped organizations couldn't restore.


    What's particularly concerning is the attacker's operational discipline in targeting the entire infrastructure stack, not just data at rest. By identifying and disabling Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL in preparation for encryption, the attacker transformed what could have been a recoverable incident into a business-critical emergency. The victim faced not just data loss, but the inability to spin up backup instances or access untouched database copies.


    The IT services firm's position as a managed services provider adds another dimension: any compromise of their network potentially exposed credentials and configurations for dozens of downstream customers. This multiplier effect makes infrastructure outsourcing companies attractive targets—one breach becomes many.


    For defenders, the key lesson is that recovery capability must be treated as critically as detection and response. Backup systems that are discoverable from production networks, siloed in the same administrative domain, and controllable through stolen domain credentials are not backups—they're redundant encryption targets. Until organizations implement true air-gapped, immutable backup architectures, ransomware operators will continue to see backup systems as an operational bottleneck to eliminate rather than a genuine recovery path. — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)