Hackers Breached an IIS Server and Deployed Ransomware Across the Network the Next Day

A coordinated intrusion in June 2026 leveraged a compromised internet-facing Microsoft IIS server and an ASP.NET web shell to conduct rapid hands-on-keyboard activity and automated lateral movement, culminating in deployment of a new Rust-based ransomware family dubbed “Spirals.” Operators escalated privileges, harvested credentials (SAM and LSASS dumps), used WMI and PsExec for mass propagation, disabled endpoint and backup defenses, staged multiple tunneling/C2 tools (revsocks, Chisel, Cloudflare Tunnel) over port 443, and encrypted files using per-file AES-128 with an ECDH P-256 key while threatening data leakage via a Tor negotiation portal.