Overview
A new ransomware attack campaign called Spirals has recorded the first case of successfully encrypting the entire system of an IT services company in South Asia in less than 24 hours from intrusion. Discovered by Symantec's Threat Hunter team in mid-July 2026, the Spirals hacker group applies a double-extortion model by stealing sensitive data before conducting extensive encryption and setting a payment deadline of 6 days. The biggest risk to businesses is this group's extremely short dwell time, rendering traditional reactive defense methods ineffective.
Spirals Hacker Group Profile
The Spirals hacker group (named after their main ransomware family) is a new group of threat actors appearing on the global cybersecurity map since mid-2026.
Operating motive: Finance. The group uses a bargaining site on the Tor network to threaten to release victims' data if a ransom is not received.
Operating method: Professional and highly disciplined. Instead of using self-developed malware for the entire attack lifecycle, this hacker group prefers to use a combination of available legitimate system administration tools (Living-off-the-Land) and popular open source tools to minimize detection traces. Attack sessions are performed directly (hands-on-keyboard) by hackers to bypass real-time security blocks.
Attribution: Currently, cybersecurity agencies and security researchers have not officially attributed the Spirals hacker group to any known country or APT group.
Event Timeline
A typical Spirals attack takes place in less than 24 hours, describing the process from initial intrusion until the system is completely paralyzed:
| Timeline |
Attack Stage |
Detailed Spirals Activity |
| T0 (00:00) |
Initial Compromise |
Exploited an Internet-facing IIS web server and deployed an ASP.NET web shell to establish initial access. |
| T0 + 2h |
Credential Harvesting |
Interacted directly through the web shell, bypassed UAC, and dumped SAM and LSASS credentials to obtain privileged access. |
| T0 + 4h |
Persistence |
Enabled Remote Desktop Protocol (RDP) and created new local administrator accounts to maintain persistent access. |
| T0 + 8h |
Tunneling & Command-and-Control (C2) |
Deployed Chisel (masquerading as chrome.exe) and Cloudflare Tunnel to establish covert, encrypted communication channels. |
| T0 + 12h |
Lateral Movement |
Moved laterally across the internal network using PsExec and Windows Management Instrumentation (WMI). |
| T0 + 18h |
Data Exfiltration |
Collected sensitive data and exfiltrated it to attacker-controlled infrastructure through the previously established tunnel connections. |
| T0 + 22h |
Service Disruption |
Disabled backup services (Veeam), virtualization services (VMware), and security software (Microsoft Defender) to hinder recovery efforts. |
| T0 + 23h |
Payload Execution |
Deployed the Spirals ransomware payload (masquerading as bitsadmin.exe) and initiated large-scale encryption across the environment. |
Attack Procedure
The attack process of the Spirals hacker group strictly follows the steps to achieve maximum performance in the shortest time:
The danger in this process lies in the fact that the hacker group maintains the C2 connection through legitimate tunneling tools such as Cloudflare Tunnel and Chisel. Disguising the Chisel executable file as chrome.exe easily fools basic process monitoring solutions without carefully analyzing the command line parameters and the destination of the network connection.
Pharse 1: Initial Penetration - IIS Web Server Exploitation (T1190)
The attacker targets an IIS web server exposed to the internet, uploading an ASP.NET web shell to gain initial foothold. The web shell allows arbitrary command execution through the IIS worker process (w3wp.exe), creating the foundation for the entire attack chain that follows.
This is not a zero-day. This is exploiting an existing attack surface: a web server that is not protected well enough, exposed directly to the internet.
Phase 2: C2 Multi-Channel Setup (T1059.001, T1572)
During the first 10 minutes, three tunneling tools are deployed in parallel:
tunn.exe — tunnel tool, located in the web production directory and Windows Tasks folder
revsocks.exe — reverse SOCKS5 proxy, connecting back to attacker IP on port 443
chrome.exe (actually Chisel) — renamed tunneling tool to emulate Google Chrome
Cloudflare Tunnel client (cloudflared-windows-amd64.exe) — adds a fourth encrypted outbound channel
This combination creates four independent and redundant C2 channels, ensuring connectivity even if one or two channels are blocked by a firewall or IDS. The technique of placing files in Windows\tasks\ is a common way to blend in with valid scheduled task binaries.
Phase 3: Set up retention permissions on the target system
UAC bypass is performed to climb to local administrator
RDP is enabled to maintain the secondary remote access channel
The new local account is created to have persistence independent of the web shell
tokens.exe — token impersonation tool to acquire elevated privileges on the host
Pharse 4: Wide Area Credential Collection (T1003.002, T1003.001)
Two parallel credential harvesting methods:
SAM hive dump — dump the entire Security Account Manager hive into a password-protected archive. This method retrieves local account hashes.
LSASS memory dump — performed on multiple machines during lateral movement, using valid binary survival techniques:
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <LSASS_PID> lsass.dmp full
Combining both methods allows for both local and domain credentials to be collected — this is the foundation for lateral movement with the domain admin account.
Pharse 5: Domain-Wide Intrusion Automation (T1021.002, T1047)
Starting at 23:33 on June 16, the attacker switched to WMI-based lateral movement from the first host, targeting more than 12 machines in the first few minutes. The speed and command pattern suggest this is automated lateral movement — not manual targeting.
Abused accounts include accounts rated as domain administrators. Having a domain admin credential from Phase 4 is a prerequisite for this attack scale.
On June 17, PsExec (running with SYSTEM privileges) was used to deploy the payload to the entire prepared target list — including domain controller, file server, application server, VM, and workstation. Speed: more than 1 new target every few seconds, continuously for about 30 minutes.
Phare 6: Encoding and Double Extortion (T1486, T1489, T1490)
See details in the Spirals ransomware technical analysis section below.
Detailed Technical Analysis
Initial Access — IIS Web Shell
The ASP.NET web shell is uploaded to the IIS web server exposed to the internet. From there, the attacker spawns cmd.exe and powershell.exe via the IIS worker process (w3wp.exe) — creating a hands-on-keyboard interactive session in the first place.
This is a sign of a human operator, not an automated worm. The entire attack chain is then coordinated by a real person behind the keyboard.
Tunneling & C2 Infrastructure
The attacker uses defense in depth strategy for C2: if one channel is blocked by the firewall, three other channels are still active.
| Tool |
File Name |
Path |
Purpose |
| Custom Tunnel |
tunn.exe |
%PUBLIC%\, C:\Windows\Tasks\ |
Primary tunneling tool used to establish remote access |
| Revsocks |
revsocks.exe |
%PUBLIC%\, C:\Windows\Tasks\ |
Reverse SOCKS5 proxy for routing traffic to the attacker's server over TCP/443 |
| Chisel |
chrome.exe |
C:\Windows\Tasks\ |
Network tunneling utility disguised as the Chrome browser |
| Cloudflare Tunnel |
cloudflared-windows-amd64.exe |
Web application (production) directory |
Establishes an encrypted outbound communication channel through Cloudflare Tunnel |
Payload and tool are delivered from the same external IP and two staging domains, using the .jpg extension to disguise the file:
hxxp://185.141.216[.]194/cd.jpg
hxxp://185.141.216[.]194/cd.zip
hxxps://computer.kplus[.]com/cd.zip
hxxps://beta.padmin[.]com/mybenefits/Templates/cd.zip
Credential Harvesting
SAM dump:
reg save HKLM\SAM <output_archive_with_password>
LSASS dump qua living-off-the-land:
rundll32.exe comsvcs.dll, MiniDump <LSASS_PID> lsass.dmp full
Both techniques use built-in Windows binaries (reg.exe, rundll32.exe, comsvcs.dll) to avoid trigger alerts on many AV/EDR solutions.
Defense Evasion — The Art of Camouflage
The attacker applies multiple layers of masquerading in parallel:
bitsadmin.exe — ransomware payload name, emulates Windows utility BITS (Background Intelligent Transfer Service)
chrome.exe — Chisel tunneling tool, Google Chrome emulator
Files .jpg — actual payload served with image extension
Chisel is located at Windows\tasks\ — path usually contains scheduled task binary
An instance of the Spirals payload is dropped from the svchost.exe emulator process at:
%APPDATA%\Local\Temp\vbr2116.exe
Disable Service Before Encryption (T1489)
The PowerShell payload sent via PsExec does two things in order:
Step 1 — Disable Windows Defender:
powershell
C:\progra~1\window~1\MpCmdRun.exe -RemoveDefinitions -All -DisableRealtimeMonitoring $true Set-MpPreference -DisableIOAVProtection $true Bước 2 — Dừng 23 loại dịch vụ backup/database/virtualization:
powershell
$p=@("excha","hyper","vmms","vmcompute","virtual","veeam", "backup","acronis","veritas","commvault","SQL Server", "oracle","mysql","postgre","intuit","sage","sap","domino") $p|%{$pt=$;Get-WmiObject Win32_Service| ?{($.Name -like $pt)-or($.DisplayName -like $pt)-or($.Description -like $pt)}| ?{$.State -eq 'Running'}|%{Stop-Service -Name $.Name -Force -EA 0}}
The list of targeted services includes: Exchange, Hyper-V, VMware, Veeam, Acronis, Veritas, Commvault, SQL Server, Oracle, MySQL, PostgreSQL, Intuit, SAP, Lotus Domino. This is a classic checklist to ensure the database and backup process do not hold file handles, interrupting the encryption process.
Spirals Ransomware — Technical Analysis
Programming language: Rust
This is a growing trend in the ransomware ecosystem — Rust allows compilation to native binary independent of the runtime, is harder to decompile than C/C++, and cross-compiles easily across multiple platforms.
Encoding scheme:
Each file is encrypted using AES-128 with a private key (per-file key).
Per-file AES key is protected by ECDH P-256 attacker's public key — meaning only attacker with private key can decrypt
Files > 5 MB in size are encrypted intermittently (in chunks sprinkled with jitter) instead of entirely — this technique significantly speeds up encryption in environments with many large files
Deployment:
Sample PsExec command used to deploy:
CSIDL_WINDOWS\psexec.exe -accepteula -d -s \ powershell -nop -w 1 -enc
Payloads are placed in multiple locations to maximize coverage:
CSIDL_WINDOWS\bitsadmin.exe CSIDL_PROFILE\desktop\bitsadmin.exe CSIDL_WINDOWS\sysvol_dfsr\domain\scripts\bitsadmin.exe \\esd\bitsadmin.exe
Placing the payload in the SYSVOL domain scripts directory and network share on the domain controller is especially dangerous: both of these locations are replicated or accessible throughout the domain, allowing the payload to spread itself to machines not directly targeted by PsExec.
Ransom note: Recorded at C:\RECOVERY_SECTION.log on all affected machines.
Double extortion: The victim is directed to the Tor portal to negotiate. Attacker threatens to publish stolen data after 6 days if ransom is not paid.
Capabilities confirmed from binary analysis:
Defense evasion
File encryption
Lateral movement
Process termination
Obfuscation
Privilege escalation
The combination of an attack speed of less than 24 hours and the Spirals group's use of Rust-based malware reflects two major trends in cybercrime today:
Malware technology shift: Rust is becoming the preferred language of ransomware groups thanks to its high execution performance, ability to bypass old static signatures, and superior encryption speed through natural multithreading.
Time race of SOC centers: The dwell time (the time the hacker stays in the system before activating encryption) of historical ransomware attacks usually lasts from several weeks to several months. With Spirals, this number shrinks to less than a day. This puts SOC centers on red alert: without automated response (SOAR) scripts to immediately isolate the server when detecting tunneling behavior or dumping LSASS, human prevention is not feasible.
In the Vietnamese market, many businesses are operating old generation IIS web server systems facing the Internet but lack protection solutions such as Web Application Firewall (WAF) and are not fully monitored. This is a critical vulnerability that can easily be exploited by hacker groups like Spirals as a springboard to penetrate the corporate internal network.
Recommendation
- Immediately audit all IIS servers exposed to the internet: Check web root directories to find recently created or modified .aspx, .ashx, .asp files. Web shell files often appear at root or in the /upload/, /temp/ folders.
# Find newly created .aspx files in the last 30 days on IIS root
Get-ChildItem -Path "C:\inetpub" -Recurse -Include "*.aspx","*.ashx","*.asp" |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
Select-Object FullName, LastWriteTime, CreationTime
Block and hunt IOC network immediately: Firewall block IP 185.141.216[.]194 and two domain staging. Check the DNS query log and proxy log to find connections to these domains.
Scan hash on endpoint: Push 7 SHA-256 hash files into EDR/AV to scan the entire fleet.
Review IIS access log: Find unusual POST request patterns to .aspx files that are not from a valid user agent.
Short-term (1–7 days)
# SIGMA rule pseudo-code cho web shell detection
EventID: 4688 (Process Creation)
ParentImage: *\w3wp.exe
Image: *\cmd.exe OR *\powershell.exe
CommandLine: *
→ Alert: IIS spawning shell process
Check Cloudflare Tunnel: If the organization is not actively using Cloudflare Tunnel, any running cloudflared*.exe binary is a red flag. Check their process list and network connection.
Review scheduled tasks and local accounts: Find accounts and scheduled tasks that are not centrally managed, especially on servers with internet exposure.
Evaluate the ability to detect WMI lateral movement: Many SIEMs do not enable WMI event logging by default. Turn on Microsoft-Windows-WMI-Activity/Operational event log and create a detection rule for abnormal WMI remote execution.
Long-term
Application layer protection for IIS: Deploy WAF (Web Application Firewall) in front of the IIS server. If you do not have a separate WAF, you must at least enable IIS Request Filtering and review upload configuration.
Network segmentation: Web-facing server should NOT have direct access to domain controller or production database. This is a necessary condition — but in the Spirals attack, the attacker moved from the IIS server to the entire domain without any barriers.
Privileged Access Management (PAM): Domain admin account should not be used for daily operations. The fact that attackers have domain admin credentials from a host's LSASS dump is the leverage they need to deploy domain-wide ransomware.
Offline backup with air-gap: Make sure there is at least one backup that is not connected to the network and not in the domain. All backup solutions connected to the domain (Veeam, Acronis, Veritas) are on the Spirals kill service list before encryption.
IR retainer and tabletop exercise: Campaigns < 24 hours require the IR process to be rehearsed first. There is no time to read the playbook the first time during a real incident.
IOC & Artifacts
File Indicators (SHA-256)
| # |
SHA-256 Hash |
Classification |
Original File Name |
Role in the Attack |
| 1 |
0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141 |
Ransomware Payload |
bitsadmin.exe, vbr2116.exe |
Spirals ransomware payload responsible for file encryption using AES-128 with ECDH P-256 key exchange; developed in Rust. |
| 2 |
4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649 |
Reverse Proxy Tool |
revsocks.exe |
Reverse SOCKS5 proxy used to establish a covert C2 channel to the attacker's infrastructure over TCP/443. |
| 3 |
7f0d49b11d0a3697685622ce510c570199bf2dc76515b3f9a6b6735de8c9134b |
Tunneling Tool |
tunn.exe |
Primary network tunneling utility used to establish the main C2 channel, deployed within the first 10 minutes of the intrusion. |
| 4 |
84b9a9a1668145df04faa3d0e118e2f0acbebd3d9d260baf3a355b44c815c22d |
Tunneling Tool (Chisel) |
chrome.exe |
Chisel tunneling client renamed to masquerade as the Google Chrome browser. |
| 5 |
862a3ca7e944ccf0ff3a6d556b34faade4b68343015c35a014a43725ac14a2a1 |
Privilege Escalation Tool |
tokens.exe |
Token impersonation utility used to escalate privileges on the initially compromised host. |
| 6 |
b5d598b00cc3a28cabc5812d9f762819334614bae452db4e7f23eefe7b081556 |
Tunneling Tool (Cloudflare) |
cloudflared-windows-amd64.exe |
Cloudflare Tunnel client used to establish an encrypted outbound communication channel for command-and-control (C2). |
| 7 |
83a7e51f3787ac5a8a9884edd0a58ddbef380969aa6529d282a461a1a614a892 |
Suspicious / Unclassified |
(Unknown) |
Suspicious file observed during the intrusion that remains unclassified in the original incident report. |
Network Indicators
| # |
Indicator |
Type |
Description |
Purpose |
| 1 |
185.141.216[.]194 |
IP Address (C2) |
Attacker-controlled command-and-control (C2) server. |
Primary C2 server used for payload distribution, tool staging, and attacker communications. |
| 2 |
hxxp://185.141.216[.]194/cd.jpg |
URL (Staging) |
Payload hosted with a .jpg extension to disguise its true nature. |
Disguised payload delivery endpoint (defanged for safe sharing and detection rule development). |
| 3 |
hxxp://185.141.216[.]194/cd.zip |
URL (Staging) |
Archive containing attack tools and ransomware payloads. |
Tool and payload distribution from the primary C2 server. |
| 4 |
hxxps://computer.kplus[.]com/cd.zip |
URL (External Staging Domain) |
External staging domain used to host the payload archive. |
Alternative payload delivery infrastructure leveraging a compromised or attacker-controlled domain. |
| 5 |
hxxps://beta.padmin[.]com/mybenefits/Templates/cd.zip |
URL (External Staging Domain) |
Secondary external staging domain hosting the payload archive. |
Redundant payload distribution endpoint used during the intrusion campaign. |
File Paths — Ransomware Payload
| File Path |
Description |
Purpose |
%SystemRoot%\bitsadmin.exe |
Primary deployment location, masquerading as the legitimate Windows BITS utility (bitsadmin.exe). |
Main ransomware payload location used to evade suspicion. |
%USERPROFILE%\Desktop\bitsadmin.exe |
Copy placed on the compromised user's Desktop. |
Secondary payload location for execution or manual deployment. |
%SystemRoot%\sysvol_dfsr\domain\scripts\bitsadmin.exe |
High-risk location — stored in the SYSVOL replication directory, which is automatically replicated across all Domain Controllers. |
Enables domain-wide payload distribution through Active Directory replication. |
\\<DomainController>\esd\bitsadmin.exe |
Payload stored on a network share hosted by the Domain Controller, accessible throughout the domain. |
Facilitates lateral deployment of the ransomware across multiple hosts. |
%APPDATA%\Local\Temp\vbr2116.exe |
Payload dropped into the user's temporary directory by a process masquerading as svchost.exe. |
Temporary staging location before execution of the ransomware payload. |
| Path |
Tool |
Notes |
%PUBLIC%\tunn.exe |
Tunnel |
Deployed in the web production directory as the primary tunneling utility. |
%SystemRoot%\Tasks\tunn.exe |
Tunnel |
Placed in the Windows Tasks directory to blend in with legitimate scheduled task binaries. |
%PUBLIC%\revsocks.exe |
Revsocks |
Deployed in the web production directory as a reverse SOCKS5 proxy. |
%SystemRoot%\Tasks\revsocks.exe |
Revsocks |
Stored in the Windows Tasks directory to masquerade as a legitimate system component. |
%SystemRoot%\Tasks\chrome.exe |
Chisel |
Chisel tunneling client renamed to chrome.exe to masquerade as the Google Chrome executable. |
<WebRoot>\cloudflared-windows-amd64.exe |
Cloudflare Tunnel |
Cloudflare Tunnel client deployed within the web application's production directory to establish encrypted outbound C2 communications. |
<WebRoot>\tokens.exe |
Token Impersonation |
Token impersonation utility stored in the web application directory for privilege escalation and access token abuse. |
MITRE ATT&CK Mapping
| Tactic |
Technique ID |
Technique Name |
Observed Activity |
| Initial Access |
T1190 |
Exploit Public-Facing Application |
Exploited an Internet-facing IIS web server and deployed an ASP.NET web shell. |
| Execution |
T1059.001 |
PowerShell |
Executed Base64-encoded PowerShell payloads via PsExec. |
| Execution |
T1047 |
Windows Management Instrumentation (WMI) |
Used WMI to execute commands during the lateral movement phase. |
| Persistence |
T1136.001 |
Create Local Account |
Created new local administrator accounts to maintain persistent access. |
| Persistence |
T1021.001 |
Remote Desktop Protocol |
Enabled Remote Desktop Protocol (RDP) for remote access. |
| Privilege Escalation |
T1548.002 |
Bypass User Account Control |
Performed UAC bypass shortly after the initial compromise. |
| Defense Evasion |
T1036.005 |
Match Legitimate Name or Location |
Masqueraded malicious binaries as legitimate Windows executables (e.g., bitsadmin.exe, chrome.exe). |
| Defense Evasion |
T1027 |
Obfuscated Files or Information |
Disguised payloads using the .jpg file extension. |
| Defense Evasion |
T1562.001 |
Disable or Modify Tools |
Disabled Microsoft Defender using MpCmdRun.exe. |
| Credential Access |
T1003.002 |
Security Account Manager |
Dumped the SAM database to obtain local account credentials. |
| Credential Access |
T1003.001 |
LSASS Memory |
Dumped LSASS memory using rundll32.exe and comsvcs.dll. |
| Discovery |
T1082 |
System Information Discovery |
Enumerated system information, user accounts, network shares, and installed applications. |
| Lateral Movement |
T1021.002 |
SMB/Windows Admin Shares |
Deployed payloads remotely using PsExec over SMB administrative shares. |
| Lateral Movement |
T1047 |
Windows Management Instrumentation (WMI) |
Leveraged WMI for automated lateral movement across the environment. |
| Command and Control |
T1572 |
Protocol Tunneling |
Established covert communication channels using tunn.exe, Chisel, and Revsocks. |
| Command and Control |
T1090.001 |
Internal Proxy |
Used Revsocks to create a reverse SOCKS5 proxy for attacker communications. |
| Command and Control |
T1102 |
Web Service |
Utilized Cloudflare Tunnel to establish encrypted outbound C2 communications. |
| Impact |
T1486 |
Data Encrypted for Impact |
Encrypted victim files using AES-128 with ECDH P-256 key exchange. |
| Impact |
T1489 |
Service Stop |
Terminated 23 backup, database, and related services prior to encryption. |
| Impact |
T1490 |
Inhibit System Recovery |
Not yet verified — no confirmed evidence that Volume Shadow Copies or other recovery mechanisms were deleted in the available reporting. |
References
New Spirals ransomware encrypts victim network in under 24 hours
Spirals: New Stealthy Ransomware Deployed Against Asian IT Company | SECURITY.COM
Spirals Ransomware: 24-Hour Network Attack
New Spirals Ransomware Uses IIS Web Shell and PsExec to Encrypt IT Firm in Under 24 Hours
