A newly identified ransomware group known as Spirals has managed something that most cybercriminal crews take days or weeks to pull off. It broke into a corporate network, stole sensitive data, and encrypted every reachable system in less than 24 hours. The speed of the Spirals ransomware attack marks a shift toward faster, more automated extortion campaigns that give victims almost no time to react.
The attack targeted an IT services company in South Asia during June. The intrusion began at an exposed Internet Information Services server sitting on the public internet, a common entry point that attackers scan for constantly. Once inside, the operator uploaded a web shell built on ASP.NET, giving them a foothold to run commands remotely.
How the Spirals Ransomware Attack Unfolded
From that initial foothold, the attacker moved with unusual efficiency. They bypassed User Account Control to gain higher privileges, turned on Remote Desktop access, and created a local account to guarantee they could get back in later. To harvest credentials for further access, they pulled data from the SAM registry hive and dumped memory from the LSASS process, a technique that often exposes stored passwords and authentication tokens.
The group then used Windows Management Instrumentation to spread across more than a dozen machines on the network. To keep their access resilient even if one channel got shut down, they built in several backup connections using tools called revsocks, Chisel, and Cloudflare tunnels. This redundancy is a hallmark of attackers who plan for detection and want fallback options ready.
Before deploying the actual ransomware, the group ran a PowerShell script that disabled Microsoft Defender, wiped its threat definitions, and shut down 23 separate services tied to backups, databases, and virtualization platforms. The list included Veeam, VMware, Hyper-V, SQL Server, Oracle, and PostgreSQL. Killing these services in advance made recovery far harder for the victim and cleared the way for encryption to run without interference.
A Ransomware Payload Disguised as a System Tool
The final stage arrived quickly. Less than a day after the first compromise, the attacker deployed the encryption payload using PsExec, running it with SYSTEM-level privileges for maximum reach across the network. The file was named bitsadmin.exe, a clear attempt to disguise it as the legitimate Windows Background Intelligent Transfer Service utility so it would blend in with normal system activity.
Spirals is written in Rust and relies on AES-128 encryption, with the keys protected by an attacker-controlled ECDH P-256 public key. For files larger than 5MB, the malware uses intermittent encryption, meaning it only scrambles portions of each file rather than the whole thing. This shortcut lets attackers lock down massive amounts of data in far less time than full encryption would take.
Once the encryption finished, a ransom note titled RECOVERY_SECTION.log appeared on the C drive with instructions for negotiating payment. Victims were warned that stolen data would be published within six days if the ransom went unpaid, a pressure tactic that has become standard across double-extortion ransomware operations.
What Makes This Threat Different
So far, this single South Asian case is the only confirmed instance of the Spirals ransomware attack. That leaves open questions about whether Spirals will become a recurring threat used against many organizations or whether it was built as a one-time custom tool for this particular target. Either way, the operational speed on display here is notable. Compressing an entire attack chain, from initial access to full encryption, into under 24 hours leaves defenders with a razor-thin window to detect and stop the intrusion before serious damage occurs.
This pace also reflects a broader trend in ransomware operations. Groups increasingly automate reconnaissance, credential theft, and lateral movement so human operators only need to step in for the final stages. Because detection tools often rely on spotting patterns over time, compressed attack timelines can slip past monitoring systems that expect slower, more gradual intrusions.
Reducing Exposure to Fast-Moving Ransomware
Organizations can take practical steps to reduce their risk. Public-facing servers, especially IIS deployments, need regular patching and should never sit exposed without a clear business reason. Monitoring for unusual PowerShell activity, unexpected service shutdowns, and unfamiliar remote access tools like Chisel or revsocks can help catch intrusions before encryption begins. Segmenting networks also limits how far an attacker can move laterally once they gain a foothold, buying defenders critical time.
For individuals and remote teams connecting to corporate systems, using a reputable VPN adds a layer of protection against credential interception and man-in-the-middle attacks, particularly on unsecured networks. Combined with strong endpoint monitoring, these measures reduce the odds of falling victim to fast-moving threats like Spirals.
Final Thoughts
The Spirals ransomware attack shows how quickly a determined threat actor can move once they find a single exposed entry point. What used to take ransomware groups days now sometimes takes hours, and that shift demands faster detection and tighter security hygiene from every organization with an internet-facing footprint. Staying ahead of threats like this means treating exposed servers, unpatched software, and unusual account activity as urgent problems rather than items for the next maintenance cycle.
