Malware

Spirals

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

The attack occurred in June and breached an IT services firm in South Asia after compromising an Internet Information Services (IIS) server exposed on the public web.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

...used WMI to move laterally to more than a dozen systems...

T1059.001PowerShellEvidence1

A PowerShell payload disabled Microsoft Defender, removed its threat definitions, and stopped services associated with 23 backup, database, and virtualization products...

Persistence

2 techniques

T1136.001Local AccountEvidence1

...enabled Remote Desktop, and created a local account to maintain persistent access.

T1505.003Web ShellEvidence1

The attacker moved quickly after obtaining initial access and uploading an ASP.NET web shell.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence1

The Spirals operator then bypassed User Account Control (UAC)...

Stealth

3 techniques

T1036MasqueradingEvidence2

The payload was named bitsadmin.exe, likely to masquerade as the legitimate Windows utility associated with the Background Intelligent Transfer Service...

T1070.004File DeletionEvidence1

A PowerShell payload disabled Microsoft Defender, removed its threat definitions...

T1218System Binary Proxy ExecutionEvidence1

The deployment of the Spirals payload (bitsadmin.exe) occurred less than 24 hours after the initial compromise... The payload was named bitsadmin.exe, likely to masquerade as the legitimate Windows utility...

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

The attacker also dumped the SAM registry hive and LSASS process memory in an attempt to extract credentials.

T1003.001LSASS MemoryEvidence1

The attacker also dumped ... LSASS process memory in an attempt to extract credentials.

T1003.002Security Account ManagerEvidence1

The attacker also dumped the SAM registry hive...

Lateral Movement

2 techniques

T1021.001Remote Desktop ProtocolEvidence1

The Spirals operator then bypassed User Account Control (UAC), enabled Remote Desktop...

T1021.002SMB/Windows Admin SharesEvidence2

The following day, the operator began deploying the ransomware payload across the victim’s network using PsExec running as SYSTEM.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Payloads and tools were delivered from the same external IP and from two external staging domains, in some cases, using .jpg extensions to disguise the files.

Exfiltration

1 technique

T1537Transfer Data to Cloud AccountEvidence2

The ransom note threatens to publish stolen data after six days if a ransom is not paid

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

...from initial access to data theft and encryption, in less than 24 hours... encrypting files on impacted machines.

T1489Service StopEvidence2

it enumerated and forcibly stopped any running services whose names, display names, or descriptions matched a broad list of 23 backup, database, and virtualization products

Other

1 technique

T1562Impair DefensesEvidence1

Symantec investigators say that the threat actor tried to remove security software on the hosts... A PowerShell payload disabled Microsoft Defender, removed its threat definitions...

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

symantec blogNews

Jul 16, 2026

Spirals: New Stealthy Ransomware Deployed Against Asian IT Company | SECURITY.COM

A previously unseen Rust-based file-encrypting ransomware used in a double-extortion attack. It encrypts files, threatens to leak stolen data, includes defense evasion, lateral movement, process termination, obfuscation, and privilege-escalation capabilities, and uses per-file AES-128 keys wrapped with an attacker-controlled ECDH P-256 public key.

bleeping computerNews

Jul 16, 2026

New Spirals ransomware encrypts victim network in under 24 hours

Rust-based ransomware that conducted a rapid intrusion, theft, and encryption operation in under 24 hours. It encrypts files, uses intermittent encryption for files larger than 5MB to speed execution, drops a ransom note named RECOVERY_SECTION.log, and threatens public exposure of stolen data unless payment is made.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Spirals

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

The attack occurred in June and breached an IT services firm in South Asia after compromising an Internet Information Services (IIS) server exposed on the public web.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

...used WMI to move laterally to more than a dozen systems...

T1059.001PowerShellEvidence1

A PowerShell payload disabled Microsoft Defender, removed its threat definitions, and stopped services associated with 23 backup, database, and virtualization products...

Persistence

2 techniques

T1136.001Local AccountEvidence1

...enabled Remote Desktop, and created a local account to maintain persistent access.

T1505.003Web ShellEvidence1

The attacker moved quickly after obtaining initial access and uploading an ASP.NET web shell.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence1

The Spirals operator then bypassed User Account Control (UAC)...

Stealth

3 techniques

T1036MasqueradingEvidence2

The payload was named bitsadmin.exe, likely to masquerade as the legitimate Windows utility associated with the Background Intelligent Transfer Service...

T1070.004File DeletionEvidence1

A PowerShell payload disabled Microsoft Defender, removed its threat definitions...

T1218System Binary Proxy ExecutionEvidence1

Credential Access

3 techniques

T1003OS Credential DumpingEvidence1

The attacker also dumped the SAM registry hive and LSASS process memory in an attempt to extract credentials.

T1003.001LSASS MemoryEvidence1

The attacker also dumped ... LSASS process memory in an attempt to extract credentials.

T1003.002Security Account ManagerEvidence1

The attacker also dumped the SAM registry hive...

Lateral Movement

2 techniques

T1021.001Remote Desktop ProtocolEvidence1

The Spirals operator then bypassed User Account Control (UAC), enabled Remote Desktop...

T1021.002SMB/Windows Admin SharesEvidence2

The following day, the operator began deploying the ransomware payload across the victim’s network using PsExec running as SYSTEM.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Payloads and tools were delivered from the same external IP and from two external staging domains, in some cases, using .jpg extensions to disguise the files.

Exfiltration

1 technique

T1537Transfer Data to Cloud AccountEvidence2

The ransom note threatens to publish stolen data after six days if a ransom is not paid

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

...from initial access to data theft and encryption, in less than 24 hours... encrypting files on impacted machines.

T1489Service StopEvidence2

it enumerated and forcibly stopped any running services whose names, display names, or descriptions matched a broad list of 23 backup, database, and virtualization products

Other

1 technique

T1562Impair DefensesEvidence1

Symantec investigators say that the threat actor tried to remove security software on the hosts... A PowerShell payload disabled Microsoft Defender, removed its threat definitions...

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

symantec blogNews

Jul 16, 2026

Spirals: New Stealthy Ransomware Deployed Against Asian IT Company | SECURITY.COM

bleeping computerNews

Jul 16, 2026

New Spirals ransomware encrypts victim network in under 24 hours

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.