The emergence of the Spirals ransomware group marks a shift toward high-velocity intrusions where the window for detection is significantly narrowed. According to Bleeping Computer, recent forensic analysis by Sophos researchers revealed an incident where the entire attack chain—from initial entry to the deployment of the Ransomware payload—occurred within a 24-hour window. This rapid turnaround minimizes the time a SOC analyst has to respond before data is permanently lost or encrypted.
Technical Analysis of the Spirals Attack Chain
The TTP employed by Spirals often begins with compromised credentials for remote access services. In the documented case, the threat actors gained entry via a compromised account on a ScreenConnect (now ConnectWise ScreenConnect) instance. Unlike many APT groups that prefer long-term persistence to maintain a quiet presence, Spirals prioritizes speed to achieve financial objectives before defensive measures can be enacted.
Once initial access is established, the attackers utilize a combination of built-in Windows utilities and legitimate third-party administrative tools to map the environment. During the discovery phase, they were observed using net.exe and nltest.exe to identify domain controllers and network shares. To identify high-value targets across the subnet, the group deployed Advanced IP Scanner and SoftPerfect Network Scanner. These tools are often overlooked by basic EDR signatures because they are frequently used by legitimate IT staff.
How to Detect Spirals Ransomware Activity
Identifying this threat requires monitoring for specific anomalies in administrative tool usage. Defenders should look for the deployment of PsExec for Lateral Movement. In the Spirals campaign, PsExec was used to execute commands across the network, facilitating the spread of the infection. Furthermore, the group utilizes Rclone for data exfiltration. Because Rclone is a standard tool for syncing files to cloud storage, it frequently bypasses SIEM alerts unless specific egress monitoring is in place. Monitoring for large outbound data transfers to common cloud storage providers is a critical IoC for this group.
Data Encryption and Payload Delivery
After exfiltrating sensitive corporate data—a tactic known as double extortion—the attackers deployed the ransomware binary. The Spirals payload is designed for speed, utilizing efficient encryption algorithms to lock local and networked drives. Before the final encryption phase, the actors were seen attempting to disable security software and delete Volume Shadow Copies to prevent recovery. This stage of the MITRE ATT&CK framework is often the loudest, but in the case of Spirals, it occurs so late in the 24-hour cycle that remediation is often impossible without backups.
Mitigate Spirals Ransomware Encryption
To effectively reduce the risk of a successful intrusion, organizations should prioritize the security of remote management and monitoring (RMM) tools. The use of Zero Trust principles is highly recommended, ensuring that even if credentials are stolen, the lack of multi-factor authentication (MFA) prevents the attacker from gaining C2 access.
Defenders should implement the following controls:
- Enforce hardware-based MFA for all RMM and VPN gateways to prevent credential-based entry.
- Restrict the use of
net.exe,nltest.exe, and PsExec to authorized administrative service accounts only. - Block or alert on the execution of Rclone and similar synchronization tools if they are not part of the standard business workflow.
- Ensure that backups are immutable and stored off-site to negate the impact of shadow copy deletion.