A new and aggressive ransomware variant, dubbed "Spirals," has demonstrated its capability to infiltrate and encrypt an entire victim network in less than 24 hours, from initial access to data exfiltration and encryption. This rapid operational tempo highlights an evolving threat landscape where adversaries are accelerating their attack timelines, giving defenders minimal time to react. The incident, which occurred in June 2026 and was detailed by Symantec's Threat Hunter Team on July 16, 2026, targeted an IT services firm in South Asia.

Chronology of the Attack

The attack began with initial access gained by compromising an Internet Information Services (IIS) server that was exposed to the public web. Once inside, the threat actor swiftly uploaded an ASP.NET web shell, establishing a foothold within the target network.

Following initial access, the Spirals operator moved with remarkable speed. They bypassed User Account Control (UAC), a Windows security feature, and enabled Remote Desktop (RDP) to facilitate further remote access. To ensure persistence, a local account was created. The attackers then focused on credential harvesting, dumping the Security Account Manager (SAM) registry hive and Local Security Authority Subsystem Service (LSASS) process memory to extract sensitive login information.

Lateral movement was executed using Windows Management Instrumentation (WMI), allowing the ransomware group to spread across more than a dozen systems. A key step in the attack chain involved attempts to remove security software on the hosts, weakening the victim's defenses. Redundant remote access channels were established through tools like `revsocks`, `Chisel`, and Cloudflare tunnels, ensuring multiple avenues for command and control.

A PowerShell payload was then deployed, specifically designed to disable Microsoft Defender, remove its threat definitions, and halt services associated with 23 different backup, database, and virtualization products, including Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL. This pre-encryption step aimed to prevent data recovery. Finally, the Rust-based ransomware payload, disguised as `bitsadmin.exe` to masquerade as a legitimate Windows utility, was deployed across the network using PsExec, encrypting files on affected machines. Spirals ransomware utilizes AES-128 keys protected by an attacker-controlled ECDH P-256 public key and employs intermittent encryption for files larger than 5MB to speed up the process.

Impact and Implications

The primary impact of the Spirals ransomware attack was the rapid and widespread encryption of the IT services firm's network, effectively crippling operations in under a day. The extensive disabling of security and backup systems further compounded the damage, making recovery significantly more challenging. This incident underscores a worrying trend where ransomware groups are becoming more efficient and sophisticated, shortening the window of detection and response for organizations. The use of legitimate tools and techniques, often referred to as "living off the land" (LOTL), also makes detection more difficult.

How to Protect Your Organization

1. Strengthen Initial Access Vectors: Ensure all internet-facing services, especially IIS servers and RDP, are rigorously secured, regularly patched, and protected by strong authentication, including multi-factor authentication (MFA). Implement strict network segmentation to limit the blast radius of a breach. 2. Enhance Endpoint Detection and Response (EDR): Deploy and maintain robust EDR solutions capable of detecting abnormal behavior, even when legitimate tools are being abused. Ensure security software is configured to resist tampering. 3. Implement Robust Backup and Recovery Strategies: Regularly back up critical data to isolated, immutable storage. Test your recovery procedures frequently to ensure business continuity in the event of an attack. 4. Practice Principle of Least Privilege: Restrict user and service account permissions to only what is necessary for their function. This limits the damage an attacker can inflict if an account is compromised. 5. Conduct Regular Penetration Testing and Vulnerability Assessments: Proactively identify and remediate weaknesses in your network and applications that could be exploited by ransomware gangs.