Spirals ransomware is a newly discovered threat that targets organisations using Windows, IIS, and Active Directory. Symantec has detailed a June 2026 attack where Spirals breached an IT services firm, moving from initial access to full network encryption in less than 24 hours. This event highlights the urgent risks facing UK organisations with similar environments.
Spirals ransomware: Attack timeline and initial compromise
The attack began on June 16, 2026, at 22:21 local time. The threat actor gained initial access by compromising an internet-facing IIS web server. Quickly, they uploaded an ASP.NET web shell, immediately establishing a covert foothold. Within minutes, the attackers deployed three tunnelling tools: Chisel (disguised as ‘chrome.exe’), a Cloudflare tunnel client, and a third unnamed tool, ensuring redundant command and control channels to the compromised network.
To escalate privileges, the attackers used a token impersonation tool, likely to gain domain administrator-level access. Over a focused three-hour period, they leveraged the IIS worker process to perform several damaging actions:
- Spawned
cmd.exeandpowershell.exefor hands-on-keyboard activity - Bypassed User Account Control (UAC)
- Enabled Remote Desktop Protocol (RDP)
- Created a persistent local account for future access
- Dumped the Security Account Manager (SAM) hive to harvest credentials
- Attempted to disable endpoint security tools
By 23:07, the attackers had already begun disabling security defences, paving the way for broader lateral movement.
Automated lateral movement and rapid network compromise
The next phase unfolded at 23:33, with lateral movement employed through Windows Management Instrumentation (WMI). Using stolen domain administrator credentials, the attackers rapidly compromised more than a dozen machines in minutes. The speed and scale of this lateral movement strongly suggest automated scripts or pre-planned targeting, rather than manual exploration.
This methodology mirrors tactics used in previous attacks against Microsoft SharePoint and other perimeter services, where initial compromise is followed by rapid, automated propagation.
On June 17 at 14:12, the attackers shifted to PsExec, a legitimate Microsoft Sysinternals tool, as their main deployment method. A single compromised workstation pushed an identical, base64-encoded PowerShell payload to dozens of endpoints every few seconds, continuing for around 30 minutes. This allowed the ransomware to spread with remarkable efficiency across the network, including to servers and workstations not initially affected by the WMI phase.
Payload deployment, defence evasion and data encryption
The payload delivered via PsExec took aggressive actions to ensure successful encryption:
- Disabled Windows Defender’s real-time monitoring
- Terminated over 20 critical backup, database and virtualisation services, including Veeam, VMware, SQL Server, and Exchange
- Cleared open file handles to avoid encryption failures
To evade detection, the ransomware executable was named bitsadmin.exe, mimicking a legitimate Windows tool. It was staged in multiple locations, most notably in the SYSVOL domain scripts directory. This enabled automated replication to machines not directly targeted by the PsExec script, using built-in domain mechanisms to reach more endpoints.
Spirals ransomware is written in Rust and features robust capabilities for defence evasion, automated lateral movement, process termination, and privilege escalation. The cryptographic operations are significant:
- Each file is encrypted with a unique AES-128 symmetric key
- These keys are then secured with an attacker-controlled asymmetric ECDH P-256 public key
This layered encryption model makes recovery without the attacker’s private key virtually impossible.
Impact, exploitation status, and affected environments
The targeted IT services firm experienced full network encryption in less than 24 hours from the initial breach. The attacker’s tactics—targeting widely used products such as Windows Server, IIS, Active Directory, Veeam, VMware, SQL Server, and Exchange—are highly relevant to UK small and medium-sized businesses (SMBs) with similar technology stacks.
There is currently no public indication that Spirals ransomware is being used in widespread campaigns. However, the techniques employed (web shell deployment, tunnelling, token impersonation, automated lateral movement, mass disabling of defences, and domain script propagation) are well-suited for reuse by other threat actors against similar environments. At the time of reporting, the original Symantec research notes that the Spirals payload appears to be unique or customised, and the threat actor has not yet been publicly attributed to any known group.
The attack demonstrates how modern ransomware groups can blend legitimate administrative tools with sophisticated malware to achieve rapid, comprehensive compromise. The use of living-off-the-land binaries and trusted channels complicates detection and response.
Why this attack matters for UK organisations
Spirals ransomware highlights the danger to organisations with exposed IIS servers, poorly monitored administrative shares, and insufficient segmentation between critical systems. The attackers’ ability to exploit common configurations and propagate through domain script directories increases the risk to any business using Windows-based infrastructure.
What organisations should do now
- Audit all internet-facing servers, especially IIS, for signs of web shell compromise
- Restrict administrative tool usage (such as PsExec) and monitor for suspicious script activity in SYSVOL
- Ensure backup and disaster recovery systems are isolated and regularly tested for ransomware resilience
Originally reported by cybersecuritynews.com.
