Spirals Ransomware — Rapid Rust Encryptor via IIS Web Shell

Spirals is a previously undocumented, Rust-based ransomware family that Symantec's Threat Hunter Team disclosed on 2026-07-17. In June 2026 the operator compromised an IT-services company in South Asia and moved from initial breach to network-wide encryption in under 24 hours. The intrusion began 2026-06-16 at 22:21 local time through an internet-facing IIS web server, where the attacker uploaded an ASP.NET web shell.

Within minutes the operator dropped three tunneling utilities for redundant, encrypted C2 over port 443: a reverse-SOCKS proxy (revsocks and a tool named tunn.exe), the Chisel tunneler renamed chrome.exe, and a Cloudflare Tunnel client (cloudflared). They escalated with a UAC bypass and token-impersonation tooling, dumped the SAM hive and LSASS (via rundll32.exe + comsvcs.dll), then used WMI to move laterally across more than a dozen hosts with a compromised domain-admin account. The next day the ransomware payload, masquerading as bitsadmin.exe, was pushed network-wide with PsExec running as SYSTEM; a base64 PowerShell stub disabled Microsoft Defender and stopped 23 backup/database/virtualization service categories first. Files are encrypted with a per-file AES-128 key wrapped under an attacker-controlled ECDH P-256 public key, with intermittent encryption on files over 5 MB. The ransom note lands system-wide as C:\RECOVERY_SECTION.log, threatening a public leak within six days via a Tor portal that names the family "Spirals".

Defender priority: The single highest-value catch is an IIS worker process (w3wp.exe) spawning a command interpreter — the web-shell foothold that precedes everything else. Pair it with detection of "living-off-trusted-names" masquerades (chrome.exe/bitsadmin.exe running from the wrong directory) and PsExec-as-SYSTEM lateral bursts. With a sub-24-hour clock, prevention and rapid isolation matter more than after-the-fact hunting.

Verbatim snapshots of every cited source are saved in Spirals-Ransomware-Hunt-sources/ for IOC provenance. Gridinsoft's write-up returned HTTP 403 and was not used. All atomic IOCs in this pack trace to snapshot 01 (Symantec primary), with the staging IP and ransom-note path also present in snapshot 03.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): An IIS worker (w3wp.exe) spawned a command interpreter or recon binary, indicating an ASP.NET web shell. Falcon: ProcessRollup2.
2. H2 (high): A tunneling binary runs under a masqueraded name or from a public web/temp directory (chrome.exe = Chisel, tunn.exe/revsocks, cloudflared). Falcon: ProcessRollup2 + NetworkConnectIP4.
3. H3 (high): LSASS or SAM credential material was dumped (rundll32.exe + comsvcs.dll MiniDump). Falcon: ProcessRollup2.
4. H4 (high): Ransomware was deployed by PsExec running as SYSTEM. Falcon: ProcessRollup2.
5. H5 (high): The payload masquerades as bitsadmin.exe from a non-system directory. Falcon: ProcessRollup2.
6. H6 (medium): A PowerShell stub disabled Defender and stopped backup/DB/virtualization services. Falcon: ProcessRollup2.
7. H7 (high): The ransom note C:\RECOVERY_SECTION.log was written. Falcon: file-write telemetry.
8. H8 (high): A host connected to staging IP 185.141.216.194. Falcon: NetworkConnectIP4.

Attack chain

Hashes and the staging IP are single-campaign, single-victim indicators; treat masquerade + tunneling behavior as the durable signal. The staging hostnames appear in the Symantec IOC list but may be attacker-abused legitimate infrastructure, so they are set to hunt, not block.

• IIS W3C logs: hunt POST requests to recently-created or unusual .aspx/.ashx files in web-production directories, especially from a single external IP with immediate follow-on GET activity. New handler files with no deployment ticket = web shell.
• Windows Security 4688: process creation where parent is w3wp.exe and child is a shell or recon tool. Also flag tokens.exe, tunn.exe, chrome.exe, cloudflared*.exe from web/temp paths.
• Service install (System 7045): PSEXESVC service registrations across many hosts in a short window signal mass PsExec push.
• SYSVOL / netlogon change audit: unexpected writes to the SYSVOL domain scripts directory or the \Windows\Tasks folder (tool-staging locations reported by Symantec).
• Defender operational log (5001/5010/5012): real-time protection disabled or tamper events cluster immediately before encryption.
• Security 1102: event-log clears during the intrusion window.
• DA logon baseline (4624/4672): domain-admin interactive/network logons to servers that never normally see them, in the hours before deployment.

Promote Q7 (comsvcs MiniDump) and the tunneler patterns to prevention first: both are low-FP and sit early in the chain. Gate the web-shell IOA to your IIS/server policy to avoid workstation noise.

1. Enable LSASS protection (RunAsPPL)

# Requires reboot. Deploy via GPO/registry to servers + workstations.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f
# Verify:
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL

2. Enforce Defender Tamper Protection + key ASR rules (PowerShell)

# Tamper Protection is managed via Intune/MDE policy; confirm state locally:
Get-MpComputerStatus | Select-Object IsTamperProtected, RealTimeProtectionEnabled

# ASR: block credential stealing from LSASS
Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Enabled
# ASR: block process creations from PsExec and WMI commands
Add-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c -AttackSurfaceReductionRules_Actions Enabled

3. Block the staging IP at the host firewall

New-NetFirewallRule -DisplayName "Block Spirals staging 185.141.216.194" `
  -Direction Outbound -RemoteAddress 185.141.216.194 -Action Block -Profile Any

4. Hunt rogue web-shell files under IIS roots (PowerShell)

# Flag recently-written handler files in web roots (review each hit).
Get-ChildItem -Path C:\inetpub\wwwroot -Recurse -Include *.aspx,*.ashx,*.asmx -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  Select-Object FullName, LastWriteTime, Length | Sort-Object LastWriteTime -Descending

Assume every credential on any host where LSASS or SAM was dumped is compromised, including the domain-admin account used for lateral movement. Password rotation without krbtgt reset leaves Kerberos persistence intact.

Known gaps: WMI-based lateral movement (T1047) has no dedicated CQL here and should be covered by a broad WMI/wmic/WmiPrvSE.exe child-process hunt in your tenant. SAM-hive dump and UAC bypass are covered indirectly (ASR / hash) rather than by a purpose-built query. Validation gates in Section 11 must pass before promoting any FP-medium query to prevention.

Generated 2026-07-23 · HuntPack v0.1 · Defensive detection and hardening content only.