Spirals ransomware breached a South Asian IT services firm and encrypted its network in under 24 hours

A newly identified ransomware actor called Spirals broke into a South Asian IT services company and went from initial access to data theft and encryption in less than a day. Symantec says the attackers entered through an internet-exposed Microsoft IIS server, uploaded an ASP.NET web shell, enabled Remote Desktop, dumped credentials from the SAM and LSASS, moved laterally with Windows Management Instrumentation (WMI) and PsExec, and used revsocks, Chisel, and Cloudflare Tunnel for persistence. The Rust-based ransomware used intermittent encryption to speed up locking files and dropped a ransom note named RECOVERY_SECTION.log.