NightSpire Ransomware Abuses RDP for Stealthy Persistence

NightSpire is an emerging cross-platform ransomware campaign (observed March–June 2025) that uses double-extortion: operators exfiltrate sensitive files (compressed with 7-Zip and uploaded via MEGAsync/MEGA) then encrypt victims' systems with a Go-based encryptor that appends ".nspire" and targets OneDrive-synced files. The group abuses legitimate remote-admin tools (Chrome Remote Desktop, AnyDesk) and RDP for stealthy persistence and access, impacting at least 64 organizations across 33 countries in healthcare, government, finance, manufacturing, and IT services.