Spirals Ransomware Deploys Double‑Extortion Attack on South Asian IT Services Firm
What Happened — In June 2026 a previously unknown ransomware family, Spirals, was used in a double‑extortion campaign against an IT services provider in South Asia. Attackers first compromised an internet‑facing IIS web server, installed an ASP.NET web shell, escalated privileges, dumped the SAM hive and LSASS memory, and then moved laterally with PsExec to encrypt files across the network. The ransom note threatens public release of the stolen data after six days.
Why It Matters for Compliance & Audit Readiness
- The incident illustrates a classic breach of the SOC 2 Security principle: failure to protect against unauthorized access, privilege escalation, and data exfiltration.
- Continuous evidence of endpoint‑security controls, privileged‑access monitoring, and incident‑response playbooks is essential to demonstrate a defensible audit trail.
- Mapping the attack steps to SOC 2 controls (e.g., CC6.1 – Logical Access, CC7.1 – System Operations) enables rapid evidence collection for auditors.
Who Is Affected – Professional‑services firms, especially Managed Service Providers (MSPs) and other IT outsourcing companies handling client environments.
Recommended Actions
- Verify that internet‑facing servers are hardened and that web‑application firewalls are in place.
- Review and enforce least‑privilege policies; ensure UAC bypass mitigations and privileged‑account monitoring are active.
- Confirm that endpoint‑security solutions generate immutable logs and that those logs are retained for audit purposes.
- Update incident‑response runbooks to include rapid containment of web‑shell activity and credential‑dumping techniques.
Source: Broadcom Symantec Blog
Technical Notes – Attack vector: compromised IIS web server → web‑shell → UAC bypass → LSASS dump → PsExec lateral movement. Payload written in Rust, masquerading as bitsadmin.exe. Double‑extortion via data theft and encryption. Source: Broadcom Symantec Blog