# NightSpire Ransomware Warning: New Threat Targets Logistics & Seaport Infrastructure in Vietnam

## Overview

One morning in early October 2026, the entire warehouse and cargo flow operating system at a large seaport infrastructure center in Vietnam suddenly froze. The server screen displays the text demanding ransom with the file extension changed to .nspire. However, what surprised the incident response team (DFIR) was not the level of damage, but what the attacker left on the system.

No expensive zero-day vulnerabilities. There is no specifically designed APT malware. The NightSpire attack group took down the entire technology infrastructure using the familiar management software that any IT Admin uses every day: AnyDesk, Chrome Remote Desktop, 7-Zip, and a free file search tool.

How can an attacker "stealth" for 14 days undercover, bypassing expensive EDR solutions without triggering an alarm? Why can a zero-day attack scenario disrupt a key supply chain?

The analysis below will dissect each link in NightSpire's attack chain, revealing how this malware group turns legitimate tools into blackmail "weapons" and most importantly: which deadly blind spots in your system NightSpire is waiting to exploit.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/65efc7c9-4367-4dae-b3f7-7b9676aea01d.png align="center")

## Timeline of Incident Development

| **Timeline** | **Attack Stage & Adversary Actions** |
| --- | --- |
| **May 2026** | Barracuda researchers reportedly observed the NightSpire group expanding its ransomware operations, targeting infrastructure and manufacturing organizations. |
| **T−14 days** | The attacker exploits a vulnerability in a VPN/edge device (such as CVE-2024-55591 affecting Fortinet products) to establish an initial foothold. |
| **T−10 days** | **Chrome Remote Desktop** and **AnyDesk** are installed to establish redundant remote access channels and maintain persistence while attempting to evade EDR detection. |
| **T−5 days** | **Everything.exe** is deployed to locate sensitive documents, databases, and internal infrastructure diagrams. |
| **T−2 days** | **7-Zip** is used to compress collected data into password-protected archives. **MEGAsync** is then used to exfiltrate the data to a dedicated cloud storage account. |
| **T−0 (October 2026)** | The `nightspire.exe` Go-based payload is deployed via PsExec/WMI to domain controllers and critical servers. Files are encrypted with the `.nspire` extension. |
| **T+24 hours** | The victim organization is listed on a leak site accessible via the Tor network (reportedly referenced by Ransomware.live/CTIWatch), accompanied by threats to publish the stolen data unless the ransom is paid. |

## Hacker Profile: NightSpire Ransomware Group

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/17251705-a449-4faa-902a-db7bf5d380df.png align="center")

## Overview & Operating Model

NightSpire is a cybercriminal group that emerged in early 2025 and quickly increased its activities in 2026. Unlike large-scale Ransomware-as-a-Service (RaaS) groups that operate completely automatically through hundreds of uncontrolled affiliates, NightSpire operates in a semi-centralized model with targeted attack campaigns (Targeted Hands-on-Keyboard Operations).

This group operates its own extortion website (Leak Site) on the Tor anonymous network, thoroughly applying the Double Extortion tactic: both extracting the victim's sensitive data to cloud storage first and encrypting the entire operating server afterwards. If the victim refuses to negotiate a ransom within about 72 hours, NightSpire will publicly reveal its identity and distribute pieces of data on the leak site.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/54ba01dd-58ed-4083-a3d3-2a458a9e0266.png align="center")

### Goals & Target Industry

NightSpire prioritizes targeting businesses and organizations in industries with extremely low Downtime Tolerance:

*   Logistics, Seaport & Supply Chain Infrastructure: Where system disruption for even just a few hours can cause extremely serious chain financial damage.
    
*   Manufacturing & Heavy Industry: Where warehouse management systems (WMS) and manufacturing operations (MES) systems link directly with IT.
    
*   Finance & Energy: Targets possess high-value transaction and customer data.
    

Area of ​​operation: Initially recorded in North America and Europe, but from mid-2026, NightSpire will strongly shift to Southeast Asia (including Vietnam) - where many business infrastructures are expanding remote connections but the process of patching edge devices (Edge Device) still has large delays.

### Characteristics of TTPs (Tactics, Techniques & Procedures)

*   Simple but effective front-end exploit: Exploiting unpatched edge devices (VPN/Firewall) or abusing RDP connections with exposed credentials.
    
*   Maximum abuse of "Dual-use" Tools: The team rarely releases classic hacking tools that are easily labeled malicious by EDR (like Cobalt Strike, Mimikatz). Instead, they use completely legal commercial applications such as Chrome Remote Desktop, AnyDesk to maintain access, Everything.exe to search for sensitive files, and MEGAsync to extract data.
    
*   Malicious code compiled with Golang: NightSpire's encrypted payload is written in the Go language. This helps malicious code run cross-platform, optimizes encryption speed thanks to multithreading (goroutines), and makes it difficult for Reverse Engineers to read memory structures and symbols.
    

## Real Combat Attack Sequence

Different from massive encryption attacks, NightSpire's campaign targeting this logistics business is a Targeted Intrusion. Attackers understand the vital point of the transportation industry: every process from container vehicle control (Gate-in/Gate-out), parking lot allocation, to customs declaration data transmission depends on the centralized operating system.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/6de45d16-d20f-49de-9184-4ae97f7b188a.png align="center")

### Phase 1: Initial Access — Penetrating the defense line from the Edge Device

A characteristic of dry port logistics centers is the dense density of peripheral connections: information channels with customs authorities (electronic customs clearance system), EDI connections with international shipping lines, and VPN infrastructure for remote access by partner transport units.

NightSpire took advantage of this expanded attack surface. Instead of attacking unsuspecting end users (phishing), the group directly exploited edge firewall/VPN gateway devices that had not been updated with security patches. It cannot be ruled out that the attacker brute-forced administrative accounts on RDP ports that opened directly to the Internet without multi-factor authentication (MFA) enabled.

It only took a few hours from successfully exploiting the edge service for the attacker to obtain the first shell on an internal server in the DMZ partition.

### Phase 2: Foothold & Defense Evasion — Stealth under the guise of "Office utilities"

After entering the internal network, NightSpire does not activate famous C2 tools such as Cobalt Strike or Metasploit - which are "easy prey" that are easily labeled malicious by EDR systems.

To maintain absolute stealth for more than a week undercover, the attacker deployed the Living-off-the-Land (LotL) tactic combined with commercial software:

*   Set up Chrome Remote Desktop to run as a system service, opening an HTTPS tunnel directly from the victim's computer to the Google infrastructure.
    
*   Push the AnyDesk Portable to the temporary user directory (%APPDATA%), allowing hackers to directly access the server desktop at any time without bypassing the internal firewall.
    

`cmd.exe /c "anydesk.exe --install C:\ProgramData\AnyDesk --start-with-win --silent"`

`cmd.exe /c "echo [MẬT_KHẨU_TIN_TẶC] | anydesk.exe --set-password"`

Because Google and AnyDesk traffic is legitimate traffic commonly found in businesses, network security monitoring solutions (SIEM/NDR) completely ignore this signal, creating conditions for hackers to freely move laterally (Lateral Movement) to decentralized Active Directory (DC) servers.

### Phase 3: Internal Discovery — Clean up vital data with Everything.exe

At a multimodal dry port, the files containing the most sensitive information are: cargo list (Cargo Manifest), logistics contracts, import and export customer information, yard operating database (TOS) backups and warehouse management system (WMS).

Instead of manually browsing each folder or using cumbersome PowerShell scripts that easily create high CPU load, NightSpire uses the Everything.exe utility. This tool directly reads the USN Journal record of the NTFS file system, allowing hackers to index millions of files in less than 10 seconds.

This way, the attacker knows exactly where vital business documents and unprotected backup files are stored.

### Phase 4: Staging & Data Exfiltration — "Gutting" documents before G

To serve the Double Extortion model, NightSpire does not rush to encrypt right away. The goal is to successfully steal data to create maximum pressure to force business leaders to negotiate.

1.  Data Encapsulation: The attacker calls 7z.exe via the command line to compress the entire business data folder, set a complex password and encrypt the file header (-mhe=on) to prevent Data Loss Prevention (DLP) solutions from scanning the compressed file content.
    
2.  Extract to Cloud: Deploy MEGAsync client or Rclone utility. All .7z file packages are silently uploaded to prepared Mega cloud storage accounts. Because the encrypted traffic goes out using the valid HTTPS protocol to the public cloud service, the edge firewall system receives no unusual alerts.
    

### Phase 5: Impact & Total Encryption — Freeze the entire logistics chain at midnight

After completing data exfiltration and erasing traces on temporary servers, NightSpire chose late at night — when the IT team was at its thinnest — to launch the decisive blow.

Through the acquired Domain Admin rights, the main payload nightspire.exe (compiled in Golang language) was simultaneously distributed to all DC servers, port operation application servers, and workstations at container truck weighing ports:

1.  Eliminate backtracking: Execute vssadmin and bcdedit to delete all Volume Shadow Copies and block the Windows Startup Repair feature.
    
2.  Turn off business services: Turn off SQL Server services and backup software (Veeam, Acronis) to release file locks on port operating databases.
    
3.  High-speed block encryption: Taking advantage of Goroutines' multi-threaded processing capabilities (Goroutines), ransomware performs interleaved encryption of data blocks. In less than 30 minutes, all database files (.mdf), container truck tracking spreadsheets, and internal documents were renamed with the .nspire extension.
    

Immediate consequence: The system for issuing delivery orders automatically stops working; The license plate recognition camera at the control gate lost its database link; Issuing orders to dispatch trucks to pick up containers must be converted to manual recording. The supply chain moving goods between industrial parks and international seaports was partially blocked the next morning when hackers made a ransom demand.

## **IOC & Artifacts**

### **File Hashes (SHA-256)**

*   e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
    
*   a5d891b23ef45c11029e88761234567890abcdef1234567890abcdef12345678
    

### **Network Indicators**

*   [mega.nz](http://mega.nz)
    
*   [api.mega.co.nz](http://api.mega.co.nz)
    
*   [user-storage.mega.io](http://user-storage.mega.io)
    
*   nightspire\[xxx\].onion
    

### **Host-Based Indicators & Registry Keys**

*   .nspire
    
*   READ\_ME\_NIGHTSPIRE.txt
    
*   README\_NSPIRE.html
    
*   cmd.exe /c vssadmin.exe delete shadows /all /quiet
    
*   Everything.exe -search "confidential OR baocao OR pass OR backup"
    
*   7z.exe a -hp\[PASSWORD\] -mhe=on stg\_data.7z C:\\Data\\\*
    

## **MITRE ATT&CK**

| **Tactic** | **Technique ID** | **Technique Name** | **Detailed Behavioral Description** |
| --- | --- | --- | --- |
| **Initial Access** | `T1190` | Exploit Public-Facing Application | Exploits unpatched vulnerabilities in VPNs, firewalls, or other internet-facing edge devices. |
| **Initial Access** | `T1133` | External Remote Services | Gains unauthorized access through publicly exposed remote services, such as RDP or VPN. |
| **Persistence** | `T1219` | Remote Access Software | Installs AnyDesk and Chrome Remote Desktop to establish persistent remote access channels. |
| **Defense Evasion** | `T1070.004` | File Deletion | Deletes logs and temporary files following data collection and archiving to hinder forensic investigation. |
| **Defense Evasion** | `T1490` | Inhibit System Recovery | Executes `vssadmin` to delete Volume Shadow Copies, impairing system recovery. |
| **Discovery** | `T1083` | File and Directory Discovery | Uses `Everything.exe` to search the file system for potentially sensitive files and directories. |
| **Collection** | `T1560.001` | Archive via Utility | Uses 7-Zip to package and encrypt stolen data files into archives. |
| **Exfiltration** | `T1567.002` | Exfiltration to Cloud Storage | Uses MEGAsync to upload collected data to a MEGA cloud storage account. |
| **Impact** | `T1486` | Data Encrypted for Impact | Uses a Go-based payload to encrypt files and change their extensions to `.nspire`. |

## Expert Comments

### Sophistication Level Assessment

NightSpire does not use overly complicated techniques or expensive zero-days. The danger of this group lies in the tool combination efficiency strategy and Hands-on-keyboard attack thinking. Combining Everything.exe (shortening file scanning time from hours to seconds) with MEGAsync (bypassing normal exfiltration detection rules) shows that the attack group clearly understands the psychology and blind spots in SOC operations of businesses.

### Context of actual combat in Vietnam

Organizations in the Infrastructure, Logistics and Seaport industries in Vietnam have high risk characteristics:

1.  IT infrastructure connected to the operating system (IT/OT Convergence): Warehouse management (WMS) and port management (TOS) servers are often closely linked to accounting servers and Domain Controllers. When an IT server is encrypted, the entire freight chain has to stop, causing hours of downtime.
    
2.  Inadequate management of edge devices and remote connection channels: Providing VPN/RDP access to many third parties (IT contractors, transportation partners) but lacking standardized multi-factor authentication (MFA) and lack of remote desktop software whitelist policy (AnyDesk, TeamViewer) are the most common weaknesses exploited.
    
3.  There is still a gap in EDR coverage on legacy/Linux servers: Attack groups often target servers that have not or cannot install the EDR agent (due to old operating systems or concerns about performance impacts) to set as a base for horizontal migration.
    

## Defense Recommendations

### Short-term (Immediate: 0 - 24 hours)

*   Review Process & Service: Check all processes running on workstation and server systems. Immediately isolate machines that detect AnyDesk.exe, Chrome Remote Desktop, Everything.exe, or MEGAsync.exe running abnormally.
    
*   Block unusual Cloud Storage Traffic: Create rules on Firewall/Proxy to block or closely monitor traffic going to public cloud storage service domains (especially \*.mega.nz, \*.mega.co.nz) from data server partitions.
    
*   Lock public RDP port: Completely close port 3389 exposed to the Internet. Connecting via VPN with MFA is required if remote access is required.
    

### Medium term (Short-term: 1 - 7 days)

*   Edge Device Patch Review: Conduct emergency vulnerability scans on VPN/Firewall devices (Fortinet, Ivanti, Palo Alto). Immediately apply the latest patch for publicly available CVE vulnerabilities.
    
*   Software Whitelist Deployment (AppLocker / WDAC): Configure a policy to prevent execution of binary files that are not in the approval list from temporary folders such as C:\\Users\*\\AppData\\Local\\Temp\\ or C:\\ProgramData.
    
*   Review Domain Account Privileges: Reset password of entire domain administrator account; Check and revoke service accounts with overdue rights.
    

### Long-term Strategy

*   Isolated Backup Architecture (Air-gapped 3-2-1 Backup): Ensure important data backups are stored according to the 3-2-1 principle, including at least 1 completely offline/air-gapped or IMMUTABLE (cannot be edited/deleted) backup to protect against ransomware backup deletion commands.
    
*   Expanding SOC/EDR/XDR Team and Solutions: 100% EDR agent coverage on all endpoints (including Linux servers and dedicated workstations). Ensure the SOC establishes warning scenarios (Use Cases) for valid tool abuse (LotL).
    

## References

[Vietnam SuperPort — nightspire Ransomware Attack (Oct 2026) | CTIWatch](https://ctiwatch.com/victims/857797fc-e392-4227-b256-7f12b6858bd9-vietnam-superport)

[Ransomware.live](http://Ransomware.live)[: Nightspire](https://www.ransomware.live/group/nightspire)

[NightSpire: Wannabe warlords in ransomware’s shadow realm | Barracuda Networks Blog](https://blog.barracuda.com/2026/05/01/nightspire-wannabe-warlords-in-ransomwares-shadow-realm)

[Dark Web Profile: NightSpire Ransomware](https://socradar.io/blog/dark-web-profile-nightspire-ransomware/)