Spirals Ransomware Encrypts IT Services Firm’s Network in Under 24 Hours
What Happened – In June, a new ransomware family dubbed Spirals breached an IT services firm in South Asia. Attackers gained initial foothold via a publicly exposed IIS server, deployed an ASP.NET web shell, bypassed UAC, created a persistent local account, harvested credentials, and encrypted the victim’s network within 24 hours using a bitsadmin.exe payload.
Why It Matters for Compliance & Audit Readiness
- The rapid chain—from mis‑configured internet‑facing service to credential dumping and encryption—exposes gaps in SOC 2 CC6.1 (System Operations) and CC6.2 (Incident Management) that continuous‑compliance programs must monitor.
- Demonstrating real‑time evidence that controls (e.g., hardening of public‑facing assets, privileged‑access management, and backup protection) are enforced is essential to defend against ransomware extortion.
- Mapping this incident to the Control Mapping capability helps organizations collect audit‑ready evidence of remediation and ongoing control effectiveness.
Who Is Affected – Professional‑services firms (managed‑service providers, IT consulting) and any organization exposing web servers without proper hardening.
Recommended Actions
- Map the incident to SOC 2 controls (CC6.1, CC6.2, CC7.1) and capture remediation evidence in a continuous‑compliance repository.
- Harden internet‑facing services: enforce least‑privilege, disable unnecessary IIS endpoints, and apply web‑application firewalls.
- Deploy endpoint detection with tamper‑resistant logging, enforce multi‑factor authentication for privileged accounts, and validate backup integrity offline.
Source: BleepingComputer
Technical Notes – Attack vector: exposed IIS server → ASP.NET web shell → UAC bypass → remote‑desktop enable → local account creation → LSASS & SAM dump → PowerShell payload disables Microsoft Defender & 23 backup/DB products → lateral movement via WMI, PsExec, revsocks, Chisel, Cloudflare tunnels → bitsadmin.exe ransomware encrypts files (AES‑128, ECDH‑P‑256). Source: same