Spirals Ransomware 24-Hour Strike: New Rust Double-Extortion Threat

Symantec disclosed Spirals, a new Rust ransomware that encrypted an entire network in under 24 hours. Operators disabled 23 backup services and used AES-128 with ECDH P-256 key wrapping.

Incident overview

On 16 July 2026, Symantec Threat Hunter Team disclosed Spirals, a new Rust ransomware. It encrypted an entire network at a South Asian IT services firm in under 24 hours. Operators used double extortion. Speed and tradecraft are high.

Attack timeline

| Time | Event | |------|-------| | Day 1 22:21 | Compromised internet-exposed IIS server; uploaded ASP.NET Web Shell | | Day 1 22:31 | Deployed 3 tunnel tools (tunn.exe, revsocks, Chisel disguised as chrome.exe) | | Day 1 23:33 | UAC bypass for privilege escalation; enabled RDP; created local account | | Day 1 +3h | Stole credentials from SAM and LSASS memory | | Day 2 | WMI lateral movement to 12+ machines; PsExec distributed ransomware as SYSTEM | | Day 2 ~14:12 | Disabled Defender, cleared threat definitions, stopped 23 backup/database services | | Day 2 | Deployed Spirals; completed network-wide encryption |

Technical details

Spirals ransomware traits

• Language: Rust (memory-safe, cross-platform compilation)
• Encryption: AES-128 symmetric, unique key per file
• Key protection: ECDH P-256 public-key wrap of file keys
• Large-file optimization: files >5MB use intermittent encryption (jittered chunks)
• Disguise name: bitsadmin.exe (legitimate Windows Background Intelligent Transfer Service tool)
• Ransom note: C:\\RECOVERY_SECTION.log
• Negotiation window: 6 days (Tor portal)

Evasion

Operators systematically dismantled defenses before encryption:

• Disabled Windows Defender real-time monitoring
• Cleared Defender threat definitions
• Force-stopped 23 backup/virtualization/database services:
• Veeam, VMware, Hyper-V, Acronis, Veritas, Commvault
• SQL Server, Oracle, MySQL, PostgreSQL, SAP
• Built redundant C2: reverse SOCKS proxy, Cloudflare tunnels, Chisel

Impact

• Speed: initial access to full-network encryption <24 hours
• Lateral movement: WMI + PsExec, pre-built AD target list
• Dwell time: hours
• Data theft: double extortion (encrypt + leak threat)
• Decryption: no public decryptor

Defense recommendations

• Attack surface: audit internet-exposed assets, especially IIS servers
• Tooling: watch for Chisel, revsocks, cloudflared in unexpected locations
• Defender alerts: monitor MpCmdRun.exe executing RemoveDefinitions
• PsExec: alert when many hosts receive PsExec in a short window
• Backup isolation: isolate backups from the domain; use immutable backups
• Response: 24-hour window is tight; need automated detect-and-respond

Sources

• Symantec Threat Hunter Team Spirals analysis report
• SecurityOnline Spirals technical details
• HackWire 24-hour strike analysis