New 'Spirals' Ransomware Cracks a Corporate Network in Under 24 Hours

A previously unseen ransomware family that researchers have named "Spirals" tore through a corporate network in South Asia in less than a day, Symantec's Threat Hunter Team reported on July 16. The attackers went from a single compromised web server to encrypted machines across the victim's environment in under 24 hours, a pace that leaves almost no room for detection or response.

The target was an IT services firm. The attackers first broke in by compromising an internet-facing Internet Information Services (IIS) server and dropping an ASP.NET web shell. From that foothold, they ran a rapid, hands-on-keyboard intrusion that Symantec says shows the marks of skilled operators who could easily widen their campaign.

The case is a clean window into how modern ransomware crews operate when they move fast. It also lands at a moment when extortion pressure on businesses shows no sign of easing — from the Fairlife dairy disruption at Coca-Cola to a steady stream of fresh leak portals tracked across the industry.

A foothold through a public web server

The first signs of trouble appeared on June 16, 2026, at 22:21 local time, according to Symantec's telemetry. A cluster of tunneling and reverse-proxy tools showed up on the initially compromised host within minutes of the web shell being planted.

The attackers placed three separate network-tunneling utilities in the first ten minutes of activity. One, named tunn.exe, was dropped first under a public web production directory and then copied into the Windows Tasks folder — a spot that helps a malicious binary blend in with legitimate scheduled-task files. A reverse SOCKS proxy called revsocks.exe followed, as did the Chisel tunneling tool, renamed chrome.exe to mimic the Google Chrome browser. A Cloudflare Tunnel client added yet another encrypted outbound channel.

This stacking of redundant tunnels is deliberate. Each tool gives the operators a separate path back into the network if defenders shut one down. By 23:07, telemetry already showed the attackers trying to disable security tools and pulling down more malware.

A three-hour sprint to persistence

Over a rapid interactive session, the operator established a durable presence. They escalated privileges by bypassing User Account Control (UAC), turned on Remote Desktop Protocol, and created a local account to keep access even if the original entry point was closed.

The crew enumerated users and network shares, listed installed programs, and tried to uninstall endpoint security using wmic and mpcmdrun.exe. They harvested credentials by dumping the Security Account Manager (SAM) hive into a password-protected archive. Later, as they moved across the network with Windows Management Instrumentation (WMI), they also dumped LSASS process memory on multiple machines using rundll32.exe and comsvcs.dll — a standard way to pull credentials out of live system memory.

For covert command-and-control, the operator ran revsocks to an external IP on port 443 and pushed local RDP out through the renamed Cloudflare tunnel binary. Tools and payloads were served from the same external IP and from two staging domains, in some cases disguised with .jpg extensions to slip past casual inspection.

Spreading sideways, then shutting down defenses

At 23:33 on June 16, the attackers began moving laterally with WMI from the first host toward the rest of the network. More than a dozen machines were hit in the first few minutes. The cadence and command structure looked automated rather than hand-targeted, Symantec noted.

The next day, June 17, the crew switched to PsExec as their main deployment tool. Starting at 14:44, PsExec remote sessions began pushing an identical base64-encoded PowerShell payload to machines across the environment. The decoded script did two things in sequence.

First, it turned off Microsoft Defender's real-time monitoring and stripped out its threat definitions. Second, it hunted down and forcibly stopped any running service whose name, display name, or description matched a broad list of 23 backup, database, and virtualization products — Exchange, Hyper-V, VMware, Veeam, Acronis, Veritas, Commvault, SQL Server, Oracle, MySQL, PostgreSQL, Intuit, SAP, and Lotus Domino among them. Shutting these down first is textbook ransomware behavior: it frees file handles that would otherwise block the encryptor from reaching data.

From about 14:12 on June 17, a single host used PsExec to push the same payload to a long list of remote machines in rapid succession — more than one new target every few seconds for around half an hour. The targets spanned domain controllers, file servers, application servers, virtual machines, and workstations bearing the naming conventions of a large enterprise.

The Spirals payload itself

The ransomware was dropped under the name bitsadmin.exe, likely to mimic the legitimate Windows Background Intelligent Transfer Service utility. Copies landed in several spots to maximize coverage, including the Windows directory, the user's desktop, and — most tellingly — the SYSVOL domain scripts folder and a network share hosted by a domain controller. Those two locations replicate or are reachable across the domain, giving the payload a path to machines PsExec never touched directly.

Spirals is written in Rust. Each file gets its own AES-128 key, wrapped with an attacker-controlled ECDH P-256 public key. Files larger than 5 MB are encrypted intermittently across jittered chunks to speed things up. A ransom note named RECOVERY_SECTION.log is written to the C:\ drive, pointing victims to a Tor portal and warning that stolen data will be published within six days if no payment is made. That is a classic double-extortion play: encrypt the files, then threaten to leak what was stolen.

Symantec has so far seen Spirals in only a single victim network. That leaves open whether it is a new family meant for broader deployment or a custom build crafted for this one attack. Either way, the skill on display argues for treating it as a live threat.

What defenders should watch for

Symantec published network indicators and file hashes from the documented attack so organizations can tune their defenses. The reported indicators include the external IP 185.141.216[.]194 and staging domains such as computer.kplus[.]com and beta.padmin[.]com, along with hashes for the Spirals binary, revsocks, tunn.exe, the Chisel clone, the token-impersonation tool, and the Cloudflared client.

The practical lessons map straight onto the kill chain. Keep internet-facing servers like IIS patched and monitored, since they remain a top entry point. Watch for web shells, unexpected tunneling tools, and new local accounts. Treat any attempt to disable Defender or stop backup and database services as a red flag, not routine maintenance.

For readers tracking the broader threat picture, our Cybersecurity desk covers ransomware, vulnerability disclosures, and incident response as they break. The original technical write-up is available from Symantec's Threat Hunter Team via BleepingComputer and the full Spirals threat intelligence report.

The speed is the headline. A competent crew can now own a network and start encryption before most security teams have finished their first review of the morning's alerts. Patching the front door, locking down RDP, and alerting on defense-evasion commands are the unglamorous steps that still matter most.