Spirals ransomware crew locked down an IT firm's network in under a day

Key points

• A new ransomware group calling itself Spirals broke into a South Asian IT services firm in June 2026 and encrypted its files in under 24 hours.
• The hackers got in through an Internet Information Services web server, meaning Microsoft's software for hosting websites, that was exposed to the public internet.
• Spirals uses a Rust-based file locker with AES-128 encryption and threatens to publish stolen data within six days if the victim doesn't pay.
• Symantec's Threat Hunter Team has seen only one Spirals attack so far, leaving it unclear whether the tool is built for wider use or designed for this single job.
• The attackers disabled Microsoft Defender and stopped services tied to backup and database products, including Veeam and SQL Server, before running the ransomware.

Symantec's Threat Hunter Team has published details of a group calling itself Spirals that broke into an IT services firm in South Asia in June, stole data, and encrypted files across the network in less than a day. BleepingComputer reported the findings first.

IIS servers on the public internet have featured in three Threat Vectr stories in the past 90 days, including our July report on active SharePoint attacks, and the pattern here is consistent: internet-facing Microsoft infrastructure, left unguarded, hands attackers their first foothold.

In this case the firm had left an Internet Information Services (IIS) server exposed. The attackers reached it and uploaded an ASP.NET web shell, a small script that gives an intruder a hidden back door into the server.

How did the hackers get so deep so fast?

They used well-known Windows tricks to widen their access. The Spirals operator bypassed User Account Control, the Windows prompt that asks permission before sensitive changes, switched on Remote Desktop so they could log in visually, and created a fresh local account as a fallback if anyone locked them out.

Passwords were next. The attackers copied the SAM registry hive and dumped the memory of a Windows process called LSASS, both standard sources of stored login credentials.

From there they spread. Symantec says the group used Windows Management Instrumentation, a built-in administration tool, to jump to more than a dozen other machines, then set up redundant remote access channels using revsocks, Chisel, and Cloudflare tunnels. Losing one route wouldn't lock them out.

A PowerShell script then switched off Microsoft Defender, wiped its threat definitions, and stopped services tied to 23 backup, database and virtualisation products. Veeam, VMware, Hyper-V, SQL Server, Oracle and PostgreSQL were all targeted. The aim was straightforward: kill anything that could restore files or keep them open against encryption.

Less than 24 hours after the first break-in, the payload arrived. PsExec, a legitimate Microsoft admin tool, pushed it across the network running as SYSTEM, the highest level of Windows privilege. It was named bitsadmin.exe, borrowing a real Windows utility's name to blend in.

What does Spirals itself actually do?

It's a Rust-based ransomware family. Files are encrypted with AES-128 keys, and those keys are then protected using an ECDH P-256 public key held by the attacker, so victims can't recover files without the criminals' private key.

For files larger than 5MB, it uses intermittent encryption, scrambling only portions of each file to speed things up. A ransom note called RECOVERY_SECTION.log is dropped on the C: drive with negotiation instructions. Victims are told their stolen data will be published within six days unless they pay.

Should you worry if you're a customer of the affected firm?

Symantec has seen Spirals used exactly once. Whether this is a new criminal brand being tested before wider deployment, or a custom payload built for this single target, the researchers don't yet know. What they have published are network indicators and file hashes so other defenders can watch for matching patterns.

For anyone whose personal or business data may have been held at the affected firm, the practical risk is exposure. Watch for unusual emails and login alerts over the coming weeks. The six-day publication deadline in the ransom note means that window may already have passed.