Spirals Ransomware Targets South Asian IT Services

In June 2026, a previously undocumented ransomware family named Spirals was utilized in a high-velocity double extortion attack against an IT services provider in South Asia. The attack progressed from initial access to full network encryption in less than 24 hours, demonstrating a high level of operational maturity. The ransomware is written in Rust and utilizes modern cryptographic standards and intermittent encryption techniques to maximize speed and bypass detection.

The intrusion began with the compromise of an internet-facing IIS server via an ASP.NET web shell. The attackers quickly established persistence, escalated privileges, and deployed a suite of tunneling tools including Chisel, Cloudflare Tunnel, and revsocks. Following automated lateral movement via WMI and PsExec, the actors disabled endpoint security and stopped critical services before deploying the final encryption payload.

While currently observed in a single incident, the technical proficiency of the Spirals operators suggests they are capable of broader campaigns. The use of a dedicated Tor negotiation portal and data leak threats follows the standard double extortion model, making this a significant threat to enterprise environments.