The Spirals ransomware is a newly discovered Rust-based malware family deployed in a targeted double extortion attack against a South Asian IT services company. Attackers gained initial access through a compromised internet-facing IIS web server by leveraging an ASP.NET web shell. Within 24 hours, they escalated privileges, moved laterally across the network using PsExec, and deployed ransomware that encrypts files using AES-128 keys. The attackers also harvested credentials by dumping the SAM hive and LSASS process memory, disabled endpoint security, and established persistence using multiple tunneling tools and reverse-SOCKS proxies for stealthy command-and-control communications. The ransomware campaign included threats to publish stolen data within six days, indicating a double extortion tactic. The attack demonstrates high operational security and advanced techniques, though the threat actor has not been identified.

The ransomware encrypts files across the victim network using AES-128 encryption, causing data unavailability. Additionally, the attackers exfiltrated data and threatened to publish it within six days, increasing pressure on the victim through double extortion. The attack involved disabling endpoint security and harvesting credentials, which could facilitate further compromise or persistence. The rapid deployment and advanced evasion techniques indicate a high level of operational sophistication, potentially enabling widespread impact if leveraged in future campaigns.

No specific patch or remediation is indicated for this ransomware family. Organizations should focus on detecting and preventing initial access vectors such as compromised IIS web servers and ASP.NET web shells. Monitoring for unusual lateral movement tools like PsExec, credential dumping activities, and tunneling tools can aid detection. Endpoint security solutions should be kept updated and configured to detect suspicious behavior. Since this is a targeted ransomware campaign, incident response should include isolating infected systems promptly and restoring from clean backups. There is no vendor patch or official fix for the ransomware itself. Patch status is not yet confirmed — check vendor advisories for any updates on detection or mitigation tools.