Spirals: New Rust Ransomware Deployed Across Enterprise Network…

The Symantec Threat Hunter Team has documented Spirals, a Rust-based ransomware using ECDH+AES hybrid encryption. An attack in South Asia demonstrated how full deployment can occur in less than a day from initial access.

The Symantec Threat Hunter Team has revealed a new ransomware family dubbed Spirals, written in Rust and used in a double-extortion attack against an IT services company in South Asia in June 2026. Full deployment occurred in under 24 hours from initial access. The operational speed and technical sophistication of the payload challenge conventional detection and response parameters.

Key Takeaways

Spirals is a Rust-based ransomware family employing hybrid ECDH P-256 encryption for key wrapping and AES-128 for files, with optimization for files larger than 5 MB.
Initial access came via an ASP.NET web shell on an internet-exposed IIS server; within three hours the attacker established persistence, disabled endpoint security, and dumped credentials.
Domain-wide deployment via PsExec as SYSTEM on June 17, 2026 hit more than a dozen machines in roughly 30 minutes, with the payload also distributed through the SYSVOL directory.
Symantec analysis documents eight SHA256 IoC hashes and three command-and-control channels—reverse-SOCKS, Cloudflare Tunnel, and Chisel—all installed within the first ten minutes of malicious activity.

Timeline of a Surgical Attack: June 16–17, 2026

First malicious activity was observed on June 16, 2026 at 22:21 local time. Attackers had compromised an internet-exposed IIS server and uploaded an ASP.NET web shell. From there they launched a hands-on-keyboard session via cmd.exe and powershell.exe spawned from the IIS worker process.

Over three consecutive hours the actor completed a precise sequence: UAC bypass for local privilege escalation, RDP enablement, local account creation, dumping the SAM hive into a password-protected archive, and dumping LSASS on multiple machines via rundll32.exe and comsvcs.dll. In parallel, they uninstalled endpoint security software and deployed three tunneling tools: tunn.exe, revsocks.exe, and Chisel—the latter renamed chrome.exe for masquerading.

WMI lateral movement began at 23:33 the same day, targeting more than a dozen machines. The next day at 14:12, mass deployment via PsExec as SYSTEM commenced. The window closed around 14:44, at a pace exceeding one new machine every few seconds. The base64-encoded PowerShell payload disabled Windows Defender and terminated 23 backup, database, and virtualization services before executing the ransomware proper.

"Less than 24 hours after the initial breach, the ransomware payload was being pushed to machines on the network." — Symantec Threat Hunter Team

The Rust Payload: Hybrid Encryption and Performance Optimization

The Spirals payload is written in Rust, a language offering near-C performance with memory-safety guarantees. The technical choice is not neutral: Rust-compiled code is harder to analyze than traditional C++ or .NET payloads, and the lack of a heavy runtime reduces the detection surface.

The encryption implements a hybrid scheme. Each file receives a per-file AES-128 key, wrapped with an attacker-controlled ECDH P-256 public key. This architecture eliminates the need to transmit the symmetric key in the clear: only the holder of the corresponding ECDH private key can recover the AES keys and decrypt the data. For files larger than 5 MB, the ransomware applies intermittent chunk encryption with jitter, a technique that maximizes execution speed while preserving the infeasibility of recovery without the key.

The executable payload was renamed bitsadmin.exe to masquerade as a legitimate Windows utility. The ransom note was placed at C:\RECOVERY\_SECTION.log, with an explicit threat: publication of stolen data after six days if no payment is made. The onion negotiation site identifies the ransomware as "Spirals."

Multi-Channel Persistence and SYSVOL Placement

The attacker built a robust persistence and C2 infrastructure in the initial phase. Beyond the three tunneling tools deployed within the first ten minutes, analysis documents a reverse-SOCKS proxy on an external IP port 443 and a Cloudflare tunnel renamed to evade signature-based detection. The payload and tools were staged from an external IP and two dedicated domains, with file extensions masked as .jpg.

A particularly relevant element for Active Directory environments is the placement of the payload in the SYSVOL directory—specifically the domain scripts folder—and in domain controller shares. This choice enables automatic replication of the payload to all domain controllers, turning the AD infrastructure itself into a propagation vector.

The token impersonation tool (tokens.exe) was executed to acquire elevated privileges, completing an evasion chain that went from web access to SYSTEM across the entire domain in less than a day.

Immediate Defensive Actions

The implications for enterprise defenses are concrete and immediate. The speed of the documented attack—three hours for environment preparation, under 24 for total deployment—is significantly below the average detection and containment times reported in incident response benchmarks. This asymmetry demands a repositioning of defensive investments.

Monitor execution of PsExec, WMI, and encoded PowerShell from non-administrative hosts, with alerting on burst lateral-movement patterns.
Restrict use of remote administration tools via access control lists and application whitelisting, preventing execution as SYSTEM by unauthorized accounts.
Regularly inspect SYSVOL contents and domain shares for unauthorized files, with particular attention to masked or renamed executables.
Implement behavioral detection on IIS worker processes spawning cmd.exe or powershell.exe, an indicator of web server compromise.

Analysis: When the Metric Becomes the Threat

Spirals introduces no zero-day vulnerabilities or novel exploits. Its danger lies in the professionalization of speed: the attacker treated ransomware deployment as a logistics operation, with early AD enumeration generating a target list ready for parallel execution. The technique is not new, but the temporal compression is.

The use of Rust, hybrid encryption with NIST-standard elliptic curves, SYSVOL placement, and systematic process-name masquerading indicate a level of preparation that does not require a known threat actor group or an established RaaS platform. The actor's identity remains unknown at this time, and no infrastructure overlaps with previously documented campaigns have emerged.

The dossier does not specify whether the victim paid the ransom or whether data was actually published, nor the amount demanded. These gaps do not diminish the analytical value: the Spirals case documents an operational threshold that traditional defenses, still anchored to detection metrics expressed in days, are not structured to contain.

Information verified against cited sources and current as of publication.

Sources

Sources and references