The Speed of the Attack
Here's what keeps me up at night: a brand-new ransomware group called Spirals walked into an IT services company in South Asia back in June 2026, stole what they wanted, and encrypted the whole network — all before the victim's Monday morning standup.
That's not a hypothetical. That's what Symantec's Threat Hunter Team documented in their latest report, and the timeline is genuinely disturbing. Initial access through a publicly exposed IIS server. Credential harvesting. Lateral movement across more than a dozen systems. Full encryption. Less than twenty-four hours from first foothold to locked doors.
The attacker didn't even bother with the usual multi-week recon phase that most ransomware groups go through. They found an open door on a web server, walked in, and started working. No phishing emails. No waiting for a vulnerable VPN to show up. Just a compromised IIS instance and the kind of operational tempo that makes security teams everywhere wince.
What's worse, Symantec has only seen this once. One case. One victim. Which means we're looking at either a highly targeted operation or something that could be deployed against anyone who leaves an IIS server exposed to the internet. Either way, the playbook is out there now.
For more on how AI-driven threat actors are accelerating attack cycles, see our guide on AI Agent Security Practices.
Post-Exploitation and Persistence
Once inside, the Spirals operator moved with the kind of methodical efficiency that suggests they've done this before — even though this is their first documented appearance.
First order of business: drop an ASP.NET web shell on the compromised IIS server. That gives them a persistent backdoor they can come back through even if something goes sideways on the initial access path. Then they bypassed User Account Control, enabled Remote Desktop Protocol, and created a local account. Standard persistence triad — web shell, RDP, new account — but executed cleanly and quickly.
The credential harvesting step is where things get really dangerous for the victim. The operator dumped both the SAM registry hive and LSASS process memory from the compromised host. SAM dumps give you password hashes. LSASS memory pulls can extract plaintext credentials, including domain admin passwords if they're cached on that machine. Between the two, you've got enough to move laterally across the entire domain.
Symantec also observed the threat actor actively removing security software from infected hosts. That's not something you do in a hurry — it takes time, and it generates noise. But they did it anyway, which tells you how seriously they took the encryption phase that was coming.
The whole post-exploitation sequence — from web shell to credential dump to security software removal — happened fast enough that the victim likely didn't even realize they'd been breached until files started disappearing.
Lateral Movement and C2 Infrastructure
This is where Spirals really shows its hand as a serious operator.
The attacker used Windows Management Instrumentation — WMI — to move laterally across the victim network, reaching more than a dozen systems. WMI is the gold standard for lateral movement in Windows environments because it's built into every modern version of Windows, it doesn't require dropping suspicious executables on disk, and it blends in with normal administrative activity. If you're seeing WMI process creation events across your environment, your SOC might not even flag it.
But the C2 infrastructure is what really stands out. Spirals didn't just set up one channel back to their command-and-control servers — they established three redundant ones: revsocks, Chisel, and Cloudflare tunnels.
Revsocks is a reverse SOCKS proxy that lets the attacker punch through firewalls and NAT without needing inbound connectivity. Chisel is a similar tool, often used for tunneling through restrictive networks. And Cloudflare tunnels? That's the clever part — by routing traffic through Cloudflare's infrastructure, the attacker gets encryption for free and makes it significantly harder for defenders to identify and block their C2 communications. Cloudflare doesn't care that you're tunneling malicious traffic as long as it looks like normal web traffic.
Three redundant channels means if one gets blocked, the others keep working. That's not amateur hour. That's operational discipline.
Pre-Encryption Preparation
Before the actual encryption started, Spirals ran a PowerShell payload that did three things simultaneously: disabled Microsoft Defender, removed its threat definitions, and stopped services for 23 backup, database, and virtualization products.
Let that sink in. Twenty-three services. Veeam. VMware. Hyper-V. SQL Server. Oracle. PostgreSQL. The kind of infrastructure that keeps an IT services company running — and the same infrastructure that would normally allow quick recovery if encryption hits.
Stopping backup services first is critical. If you can't restore from backups, the ransom becomes the only option. Stopping database services next means the encrypted data is gone — not just locked, but potentially corrupted beyond recovery. And disabling Defender with threat definition removal? That's not just turning off the antivirus. That's making sure it can't come back online even if someone tries to re-enable it.
This is the part of ransomware that separates the professionals from the script kiddies. You don't just run an encryptor and hope for the best. You systematically eliminate every recovery path before you touch a single file.
The Spirals Payload
The actual ransomware deployment happened less than 24 hours after initial compromise, and the technique is textbook.
The operator used PsExec running as SYSTEM to push the payload across the network. PsExec is a legitimate Sysinternals tool that every sysadmin has on their laptop — which makes it perfect for attackers because it doesn't trigger the same alarms as custom malware delivery tools. And they named the executable bitsadmin.exe, masquerading it as Windows' legitimate Background Intelligent Transfer Service utility. If you're looking at a process list and see bitsadmin.exe running, your first thought should be "normal Windows activity," not "ransomware."
Under the hood, Spirals is a Rust-based ransomware family. Rust is becoming increasingly popular in malware development because it produces binaries that are fast, memory-safe (which means fewer crashes during execution), and harder to reverse-engineer than equivalent C or C++ implementations. The encryption itself uses AES-128 keys, but those keys are protected by an attacker-controlled ECDH P-256 public key. That means the decrypt key never leaves the attacker's infrastructure — victims can't get it from memory dumps or intercepted network traffic.
Here's the technical detail that makes this particularly nasty: Spirals uses intermittent encryption for files larger than 5MB. Instead of encrypting every sector sequentially, it skips around. The result? Encryption completes significantly faster across a large network because the encryptor isn't bottlenecked by disk I/O on every single file. It's a clever optimization that comes at the cost of making forensic recovery slightly harder — but who needs forensics when you're paying the ransom?
The ransom note, RECOVERY_SECTION.log, lands on the C:\ drive with instructions for victims to negotiate payment. And there's a six-day countdown: pay up or the stolen data goes public.
Attribution and What Comes Next
Symantec has observed Spirals in exactly one case as of their July 2026 report. That single data point makes attribution nearly impossible, but it also raises uncomfortable questions.
Is this a full ransomware family being prepared for broader deployment? The presence of an extortion portal suggests yes — you don't build a payment infrastructure for a one-off attack. Or is this a custom payload created specifically for targeting that IT services firm in South Asia? The operational quality suggests a dedicated team, but the single-observation constraint means we can't be sure.
What we do know is that Symantec published network indicators and file hashes associated with the attack to help organizations worldwide set up defenses. If you're running IIS servers exposed to the internet, if you're seeing unusual WMI activity across your domain, or if your backup services are being stopped in bulk — these indicators might help you catch the next Spirals attempt before it completes its twenty-four-hour clock.
The broader lesson for artificial intelligence cybersecurity threats and ransomware defense in general is sobering: the gap between initial access and full encryption is collapsing. Twenty-four hours used to be generous. Now it's the new normal for well-resourced actors who don't need weeks of recon to find an open door and walk through it.
For organizations seeking to secure autonomous AI systems against similar threats, see our AI Agent Security Practices tutorial — and for how multi-agent systems are being weaponized, explore our piece on Securing Agentic AI.