Rust-Based Speed: Novel "Spirals" Ransomware Achieves Full Network Encryption in Under 24 Hours
Executive Summary
A previously unknown, highly aggressive ransomware strain named Spirals has been identified in a rapid-deployment network intrusion targeting an IT services company. Disclosed in a threat hunting report on July 17, 2026, by Symantec's Threat Hunter Team and reported by Help Net Security, the malware is written entirely in the Rust programming language, capitalizing on the language's native execution speed, memory safety, and cross-platform flexibility.
The Spirals operators execute incredibly fast campaigns, going from initial entry to complete network encryption and data theft in less than 24 hours. Utilizing a highly optimized multithreaded architecture, the malware encrypts files at scale, generating a unique, separate AES-128 key per file and wrapping each file key using an attacker-controlled ECDH P-256 public key. By splitting and encrypting files larger than 5 megabytes (MB) in isolated chunks to maximize speed, and dropping a Tor-based ransom note, Spirals represents an exceptionally high-risk, rapid-extortion threat.
Deep-Dive Technical Analysis
The adoption of modern, memory-safe compiled languages (such as Rust and Go) by ransomware developers has surged over the past year. Rust, in particular, offers significant tactical advantages over legacy C/C++ builds: its compiler enforces memory safety without a garbage collector, its execution speed is highly competitive, and its robust cross-platform libraries allow the same codebase to be easily compiled for Windows, Linux, and ESXi environments. Furthermore, because Rust binaries generate highly complex, nested assembly code, they are notoriously difficult to reverse-engineer, frequently evading signature-based security perimeters and traditional sandbox analysis.
A technical dissection of the Spirals ransomware campaign and its rapid encryption lifecycle reveals an incredibly fast, multi-stage attack methodology:
1. The Initial Entry Vector (Targeting IIS Web Servers): The Spirals operators identified and compromised an internet-facing Microsoft IIS web server belonging to the victim. The attackers exploited a public-facing vulnerability or misconfiguration to upload an ASP.NET web shell, establishing a persistent, interactive administrative backdoor.
2. Rapid Lateral Movement and Exfiltration: Within hours of gaining initial access, the attackers executed lateral movement across the internal subnet. Rather than spending days mapping the directory, the threat actors executed "smash-and-grab" harvesting scripts to locate and exfiltrate highly sensitive databases and corporate files, setting up a double-extortion campaign.
3. The Rust-Based Multithreaded Encryption Engine: Once data exfiltration was completed, the attackers deployed the primary Spirals ransomware executable. The malware is written in Rust and utilizes an optimized, multithreaded architecture to saturate host CPU cores, achieving blistering encryption speeds.
4. The Cryptographic Implementation:
* Symmetric Encryption: The malware generates a unique, separate AES-128 key to encrypt each individual target file.
* Asymmetric Key Wrapping: Each file's unique AES key is then wrapped and encrypted utilizing an attacker-controlled ECDH P-256 (Elliptic Curve Diffie-Hellman) public key, ensuring that recovery is impossible without the corresponding private key.
* Chunked Large File Encryption: To prevent performance bottlenecks on files larger than 5MB, the malware splits the files and encrypts them in isolated, selective chunks, massively accelerating the encryption phase on database and backup servers.
5. The Ransom Note: Upon completing encryption, the malware appends the custom extensions and drops a ransom note named RECOVERY_SECTION.log inside encrypted directories, directing the victim to a Tor-based negotiation portal and threatening to leak the stolen data within six days if the extortion demands are ignored.
The entire lifecycle—from initial IIS web shell upload to total network-wide encryption—took less than 24 hours, leaving traditional manual security response teams with zero time to react.
Industry Impact and Recommendations
The rise of the Rust-based Spirals ransomware demonstrates that threat actors are continuously optimizing their malware for execution speed and evasion. When a network intrusion can transition from initial entry to complete encryption in under 24 hours, traditional reactive security controls are completely ineffective.
We recommend that all system administrators, Windows engineers, and SecOps teams implement the following mitigations:
1. Harden and Secure Internet-Facing IIS Web Servers: Disable any unnecessary web services, apply immediate security patches to all web-facing applications, and configure strict access controls to prevent the execution of unauthorized scripts or web shells.
2. Deploy Advanced Behavioral Endpoint Detection (EDR): Do not rely solely on traditional, signature-based antivirus scanners that can be easily evaded by compiled Rust binaries. Enforce advanced EDR agents capable of monitoring process behaviors, automatically alerting and blocking any unknown utility attempting to initiate rapid, mass file-renaming or file-encryption activities.
3. Enforce Strict Network Micro-Segmentation: Segment all internet-facing web servers (such as IIS hosting subnets) from core, business-critical database and active directory networks. Ensure that if a perimeter server is compromised, the threat is strictly contained within a DMZ.
4. Maintain Robust, Offline (Air-Gapped) Backups: Enforce a strict 3-2-1 backup strategy. Keep regular, cryptographically signed, and completely offline (air-gapped) backups of all business-critical directories, ensuring rapid recovery without negotiating with threat actors.
References
* Help Net Security — Spirals ransomware locks down victim systems in under 24 hours
* Bleeping Computer — New Spirals ransomware encrypts victim network in under 24 hours