Spirals — Ransomware Profile
Spirals is the name of a Rust based ransomware family that Symantec's Threat Hunter Team documented on 16 July 2026, after a June 2026 intrusion at an IT services company in South Asia. According to that analysis, the operators entered through an internet facing IIS server using an ASP.NET web shell, dumped credentials, tunnelled out with Chisel and a Cloudflare Tunnel client, and pushed the encryptor across the network with PsExec less than 24 hours after the first breach. BleepingComputer reported the same case, noting per file AES-128 keys wrapped with an attacker controlled ECDH P-256 key and a ransom note giving six days before threatened publication. Symantec said the actor behind the attack remains unknown and only one intrusion had been documented. A data leak site carrying the Spirals name was first observed in our monitoring in September 2026.
IntelFusions coverage (1)
Recent claimed victims
Read the full analysis on IntelFusions