Speed-Demon Intrusion: Fast-Moving Rust-Based "Spirals" Ransomware Encrypts Corporate Networks in Under 24 Hours
Executive Summary
A previously unknown, exceptionally fast and efficient ransomware strain called Spirals was identified in a devastating attack against an IT services company in South Asia. Detailed in a threat intelligence report released by Symantec's Threat Hunter Team on July 16/17, 2026, the ransomware is coded entirely in Rust and built for maximum speed, executing initial network access, data exfiltration, and full network encryption in less than 24 hours. The threat actors gained initial access by exploiting a perimeter vulnerability in an internet-facing IIS web server and uploading a malicious ASP.NET web shell. Once inside, they mapped the network, exfiltrated sensitive databases, and deployed the Spirals payload. Utilizing a highly sophisticated encryption architecture that leverages separate AES-128 keys per file wrapped with ECDH P-256 public keys, the ransomware encrypts large files in fragmented chunks, leaving a ransom note (RECOVERY_SECTION.log) directing victims to a Tor negotiation site.
Deep-Dive Technical Analysis
Historically, ransomware intrusions required multiple days or weeks of reconnaissance, credential harvesting, and lateral movement before attackers initiated the final, destructive encryption phase. Modern, financially motivated threat actors are increasingly abandoning slow lateral exploration in favor of automated, rapid-intrusion models. By utilizing cross-platform, high-performance languages (such as Rust) and targeting automated web shells, they can compromise, exfiltrate, and encrypt corporate perimeters in a matter of hours, presenting a major challenge to security operation centers (SOCs) operating on traditional multi-day detection windows.
A technical analysis of the fast-moving Spirals ransomware intrusion and encryption lifecycle reveals several highly sophisticated tactics:
1. The Entry Vector (IIS Web Shell): The threat actors initiated the attack by targeting a vulnerable, internet-facing Microsoft IIS web server. By exploiting an exposed vulnerability, they uploaded an ASP.NET web shell, granting them persistent command-line access.
2. Automated Network Mapping and Exfiltration: Rather than conducting manual exploration, the attackers used automated scripting to map the local network and locate high-value file directories. Within hours of initial access, they packaged and exfiltrated sensitive databases to an external server.
3. The High-Performance Rust-Based Payload: Coded entirely in Rust, the Spirals ransomware is compiled as a highly optimized, multi-threaded executable. Rust is increasingly favored by modern malware authors because it offers extreme execution speed, robust memory safety, and high-level compiler optimizations, making it difficult to analyze with traditional reverse-engineering tools.
4. The Cryptographic Architecture (AES-128 and ECDH P-256): Spirals utilizes a dual-key cryptographic model designed for secure, irreversible encryption:
* Per-File AES-128 Symmetric Keys: The ransomware generates a unique AES-128 key for every single file it targets.
* ECDH P-256 Asymmetric Key Wrapping: Each per-file AES key is immediately wrapped utilizing an attacker-controlled Elliptic Curve Diffie-Hellman (ECDH) P-256 public key. In the absence of the corresponding private key, decryption is mathematically impossible.
* Fragmented Chunk Encryption: To maximize encryption speed and evade timeouts, files larger than 5 Megabytes (MB) are not encrypted in their entirety. Instead, the ransomware encrypts them in fragmented chunks, corrupting the file structure while significantly accelerating the overall execution phase.
5. The Ransom Note: Once encryption is complete, the malware drops a ransom note titled RECOVERY_SECTION.log in every affected directory, directing the victim to a Tor negotiation site and threatening to leak the exfiltrated data within six days if the ransom is not paid.
The rapid speed of the Spirals intrusion leaves security teams with an incredibly narrow window to detect and contain the threat before encryption occurs.
Industry Impact and Recommendations
The emergence of the Spirals ransomware campaign proves that enterprise detection and response metrics must operate in near-real-time. When a network compromise can transition from initial entry to complete database encryption in under 24 hours, traditional manual alerting and offline triaging are completely inadequate.
We recommend that all system administrators, Windows engineers, and enterprise SecOps teams implement the following mitigations:
1. Apply Hardened Security Controls to Web Servers: Regularly audit and harden all internet-facing Microsoft IIS and Apache web servers. Keep operating systems and web applications fully patched, and immediately remove any unauthorized, non-standard ASP.NET or PHP files from web directories.
2. Deploy Real-Time Behavioral Endpoint Detection (EDR): Because the Spirals payload executes with extreme speed, defenders must rely on automated EDR tools. Configure EDR agents to instantly alert, quarantine, and block any unauthorized process attempting to execute rapid, multi-threaded file-modification or encryption commands.
3. Enforce Strict Privilege Management on Workstations: Strictly limit the use of local administrative and domain admin credentials. Implement local admin password randomization (such as LAPS) and restrict lateral movement pathways, preventing attackers from escalating privileges across subnets.
4. Enforce Immutable, Off-Site Backups: Maintain comprehensive, daily, and completely offline (air-gapped) backups of all business-critical data. Regularly test recovery workflows to ensure systems can be rapidly restored without negotiating with extortion networks.
References:
* Help Net Security — Spirals ransomware locks down victim systems in under 24 hours
* Bleeping Computer — New Spirals ransomware encrypts victim network in under 24 hours