Spirals Ransomware Hit South Asian IT Firm After IIS Server Breach

A previously unseen Rust-based ransomware family dubbed Spirals was used in a double-extortion attack against an IT services company in South Asia, with attackers moving from initial compromise to network-wide encryption in under 24 hours. Investigators said the intrusion began through a publicly exposed IIS web server, where the attackers deployed an ASP.NET web shell, then quickly established persistence, harvested credentials, escalated access, disabled security tools, and moved laterally across the environment.

The operators maintained covert access through multiple channels including RDP, revsocks, Chisel, and Cloudflare Tunnel, and pushed the ransomware broadly with PsExec and WMI. Symantec said Spirals encrypts files using AES-128 with an attacker-controlled ECDH P-256 public key, uses intermittent encryption for files larger than 5 MB, and drops a ransom note at C:\RECOVERY_SECTION.log; the note warned that stolen data would be published within six days if payment was not made. Researchers described the attack as notably fast and stealthy, while noting only one Spirals incident has been observed so far.