A previously unknown ransomware family designated “Spirals” achieved full network encryption within 24 hours of the initial breach during a targeted attack against an IT services company in South Asia in June 2026. The Rust-based payload, which exhibits characteristics of either a purpose-built tool for this single operation or an entirely new family, leveraged a combination of web shell access, tunneling utilities, and enterprise deployment tools to move from initial compromise to domain-wide encryption with remarkable speed. The threat actor behind the operation has not been identified, but the technical discipline displayed suggests a highly skilled operator with pre-planned targeting.
Spirals Ransomware Attack Chain: IIS Web Shell to Domain-Wide Encryption
The intrusion began on June 16 at 22:21 local time when attackers compromised an internet-facing IIS web server and uploaded an ASP.NET web shell. Within minutes, three separate tunneling tools were deployed, including a Chisel instance disguised as chrome.execodecodecodecode and a Cloudflare tunnel client that established redundant, covert communication channels. A token impersonation tool followed shortly after, enabling privilege escalation from the initial foothold.
During a concentrated three-hour hands-on-keyboard session, the operator spawned cmd.execodecodecodecode and powershell.execodecodecodecode through the IIS worker process, performed a User Account Control bypass, enabled Remote Desktop Protocol, created a persistent local account, and dumped the SAM hive. By 23:07, precursor activity showed active attempts to disable security tools, signaling the transition from reconnaissance to active defense evasion.
Lateral Movement and Automated Deployment
The attackers pivoted to WMI-based lateral movement at 23:33, successfully compromising over a dozen machines within minutes using compromised domain administrator credentials. The rapid cadence strongly suggests automated, pre-planned targeting rather than manual network exploration. On June 17, the attackers shifted tactics to PsExec as their primary mass deployment vector. Starting around 14:12, a single compromised host pushed an identical base64-encoded PowerShell payload to network targets every few seconds for roughly 30 minutes.
This automated payload immediately disabled Windows Defender’s real-time monitoring and forcibly stopped over 20 critical backup, database, and virtualization services, including Veeam, VMware, SQL Server, and Exchange, effectively clearing open file handles ahead of encryption. The ransomware executable itself was named bitsadmin.execodecodecodecode to masquerade as a legitimate Windows utility. It was staged across multiple network locations, including the SYSVOL domain scripts directory, ensuring automated propagation even to machines not directly targeted by the PsExec script.
What Is Spirals Ransomware and How Does It Work?
Spirals is a full-featured, Rust-based encryptor built with defense evasion, automated lateral movement, process termination, and privilege escalation capabilities. The ransomware uses a per-file AES-128 symmetric key to secure the raw block data of targeted files, wrapped with an attacker-controlled ECDH P-256 public key to protect the local AES keys from decryption. For files over 5 MB, the encryptor employs intermittent encryption of jittered chunks to speed up the locking cycle, a technique that reduces the time required to encrypt large volumes of data while maintaining an effective denial of access.
The ransomware leaves a local footprint to force negotiation: the ransom note is dropped across the system as C:\RECOVERY_SECTION.logcodecodecodecode. It threatens the public leak of stolen corporate data within six days if the target fails to pay. The note directs victims to a Tor negotiation portal, which Symantec confirmed explicitly names the threat family as “Spirals”.
Defensive Priorities for Organizations Facing Similar Threats
While Spirals has only been observed against a single victim so far, its operational discipline signals a highly skilled actor capable of rapidly scaling attacks. The combination of layered tunneling infrastructure, credential harvesting via LSASS dumps using rundll32.execodecodecodecode and comsvcs.dllcodecodecodecode, and domain-wide propagation via SYSVOL requires an immediate defensive response. Symantec’s indicator list includes dedicated staging infrastructure hosted at 185.141.216.194codecodecodecode alongside two compromised domains used for hosting malicious payloads.
Organizations running internet-facing IIS servers should enforce the following priorities:
- Web Shell Detection: Actively monitor internet-facing web servers for unauthenticated ASP.NET file modifications or sudden process creations originating from IIS worker loops.
- Behavioral Auditing: Set immediate alerts on anomalous WMI and PsExec activity executing rapid, sequential connection attempts across internal zones.
- Credential Protection: Harden endpoints against LSASS memory dumping tools and tightly restrict domain administrator account usage on non-domain controllers.
What Affected Organizations Should Do Now
Any organization that suspects exposure to similar attack vectors should immediately audit all internet-facing IIS servers for unauthorized web shells, review domain administrator account activity for anomalous lateral movement patterns, and ensure that backup systems are isolated from the production network with immutable storage. Deploying a multi-layered endpoint protection solution with behavioral analysis capabilities can help detect and block the type of rapid, automated deployment techniques used in this attack. Additionally, implementing strict application control policies to prevent unauthorized executables from running, particularly those masquerading as legitimate system utilities, can reduce the risk of similar ransomware deployment. Finally, organizations should conduct a thorough review of SYSVOL and other domain controller shares for unauthorized binaries, as this attack demonstrated the effectiveness of using legitimate infrastructure paths for payload staging.
