Since early 2025, NightSpire ransomware has built its operations around a single critical vulnerability: CVE-2024-55591, a CVSS 9.6 authentication bypass in FortiOS and FortiProxy. The flaw, disclosed by Fortinet on January 14, 2025, allows unauthenticated attackers to gain super-admin privileges on FortiGate appliances via crafted requests to the Node.js WebSocket module. With hundreds of thousands of internet-facing devices running vulnerable versions at the time of disclosure, NightSpire had a target-rich environment from day one.
Initial Access
NightSpire's primary kill chain begins with exploitation of CVE-2024-55591 on unpatched FortiGate devices. Successful exploitation grants the attacker super-admin privileges, enabling creation of unauthorized administrative accounts and VPN tunnels into the victim network. Secondary access methods include RDP brute-force attacks, credential stuffing against exposed remote desktop services, and phishing campaigns using malicious attachments disguised as browser or security software updates.
Discovery and Lateral Movement
Once inside the network, NightSpire relies entirely on living-off-the-land binaries (LOLBins) rather than custom malware for lateral movement. The observed toolset includes Everything.exe for rapid file and directory enumeration, PowerShell for scripting and automation, PsExec and WMI for remote execution across endpoints, and Mimikatz or direct LSASS access for credential dumping on domain controllers. This exclusive reliance on legitimate tools is a deliberate evasion strategy — every tool in NightSpire's lateral movement kit exists natively or commonly in enterprise Windows environments.
Data Staging and Exfiltration
NightSpire follows a consistent three-step data theft workflow: Everything.exe enumeration to identify high-value files, 7-Zip compression for staging, followed by exfiltration via WinSCP, MEGACmd, or Rclone to attacker-controlled infrastructure. This staging-to-exfil sequence typically precedes the encryption phase and represents the best detection opportunity for defenders monitoring outbound data flows.
Encryption
The ransomware payload is written in Go (Golang) and uses multiple obfuscation layers including AES, RC4, and XOR. Encryption behavior varies by file size: large files (.iso, .vhdx, .zip) receive block-level partial encryption for speed, while smaller files are fully encrypted. All encrypted files receive the .nspire extension and a readme.txt ransom note is dropped in each affected directory. Notably, NightSpire does not delete Volume Shadow Copies — an unusual choice that prioritizes encryption speed over complete recovery prevention. The payload also specifically targets OneDrive cloud storage, corrupting synchronized files without changing their extensions.
Detection Opportunities
Proven Data identifies three high-fidelity detection sequences: FortiOS compromise followed by unauthorized admin account creation and VPN access from unrecognized sources (the primary entry point); Everything.exe execution followed by 7-Zip archive creation and outbound WinSCP/MEGACmd/Rclone connections (the exfiltration workflow); and Mimikatz or LSASS access on a domain controller followed by rapid PsExec/WMI execution across multiple endpoints (pre-encryption lateral spread). Organizations running FortiOS should prioritize patching to version 7.0.17 or later and audit for unauthorized administrative accounts.