Spirals ransomware locks down victim systems in under 24 hours

Symantec Threat Hunter Team observed a fast-moving ransomware attack by a previously unknown Rust-based strain called "Spirals" against an IT services company in South Asia; attackers gained access via a compromised IIS server and ASP.NET web shell, escalated privileges (UAC bypass), dumped credentials (SAM/LSASS), established persistent and tunneled access (reverse SOCKS, renamed Chisel, Cloudflare Tunnel), disabled security/backup services, and encrypted files using per-file AES-128 keys wrapped with an ECDH P-256 key, leaving a Tor-based ransom negotiation site and threatening data leaks.