Threats Tagged 'rust-based ransomware'

Spirals is a newly identified ransomware family deployed in a double extortion attack against an IT services company in South Asia in June 2026. The Rust-based ransomware exhibits advanced capabilities such as defense evasion, lateral movement, privilege escalation, and network-wide file encryption using AES-128. Initial access was gained through a compromised internet-facing IIS web server via an ASP.NET web shell. The attackers rapidly deployed the ransomware within 24 hours, established persistence with tunneling tools, disabled endpoint security, harvested credentials from SAM and LSASS, and used reverse-SOCKS proxies for covert command-and-control. The ransomware was distributed using PsExec and threatened data publication within six days. The threat actor remains unidentified, but the sophistication suggests potential for broader campaigns.