Spirals ransomware was first publicly documented in July 2026 by BleepingComputer, following confirmed intrusions at IT services and managed service provider organisations. The group’s defining operational characteristic is speed: Spirals operators have demonstrated the ability to complete the full kill chain from initial access to network-wide encryption in under 24 hours, a tempo that compresses the defender response window to a degree that makes detection-and-response the wrong primary control.
The group is newly documented, not newly active. The short dwell time may mean earlier intrusions were attributed to other groups or went unreported. Based on victim patterns observed as of mid-July 2026, Spirals appears to specifically target IT services organisations and managed service providers, a targeting choice with significant downstream implications.
Technical Profile
Initial Access: IIS Exploitation
Spirals gains initial access through Internet Information Services (IIS), Microsoft’s Windows web server. The specific exploitation path has not been fully detailed in public reporting, but intrusion patterns across confirmed victims indicate the use of IIS vulnerabilities — whether unpatched remote code execution flaws or credential abuse against IIS management interfaces — as the consistent entry point.
The choice of IIS as an initial access vector is relatively uncommon among ransomware operators, who more frequently target VPN appliances, RDP, and perimeter firewall products. IIS exploitation either reflects specific technical capability developed by the Spirals operators or acquisition of IIS-specific exploitation tooling. For defenders, internet-facing IIS servers — including web applications, management portals, and API endpoints running on Windows Server — should be treated as high-priority targets for patching and monitoring.
Encryption: Intermittent Mode for Large Files
Spirals uses intermittent encryption for files larger than 5 megabytes. Rather than encrypting the full file, the encryptor encrypts alternating chunks, leaving portions of the file in plaintext. The approach is designed to reduce encryption time while still rendering files unrecoverable without the decryption key.
Intermittent encryption reduces the time required to encrypt large files — including database files, virtual machine disk images, and backup repositories — by a significant factor compared to full-file encryption. This directly contributes to the sub-24-hour attack chain: the encryptor can move through a large filesystem faster than full-file encryption would allow.
The tradeoff for victims is that partial encryption still destroys file usability. A database file with alternating encrypted and plaintext blocks is not recoverable by the application that relies on it. The approach is not a shortcut that leaves files recoverable — it is a deliberate optimisation for speed.
Files smaller than 5MB appear to receive full encryption based on observed samples.
Ransom Note: RECOVERY_SECTION.log
The Spirals ransom note is dropped as RECOVERY_SECTION.log in affected directories. The .log extension is a deliberate choice — it reduces the likelihood that the file will be filtered or flagged by automated monitoring that looks for .txt or .html ransom notes, and it may delay discovery in environments where .log files are treated as operational noise.
The note content follows a standard double-extortion template: it claims data exfiltration occurred prior to encryption, sets a payment deadline, and provides contact instructions. Specific payment amounts and contact infrastructure are not yet publicly documented, consistent with the group’s recent emergence.
Lateral Movement and Speed
The under-24-hour attack chain implies aggressive lateral movement techniques executed in rapid succession rather than the multi-day dwell time characteristic of more deliberate ransomware operators. Based on available incident details, Spirals operators appear to:
- Establish persistence immediately after initial access
- Conduct rapid credential harvesting rather than extended reconnaissance
- Deploy the encryptor across the network without extended staging
This tempo is achievable when targeting IT services organisations because MSP and IT services environments typically have broad internal connectivity by design — service accounts and management tools require access to client systems and internal infrastructure. What is administrative functionality becomes an attacker’s lateral movement path.
Targeting: IT Services and MSPs
The confirmed Spirals victim set as of mid-July 2026 is concentrated in IT services and managed service providers. This targeting strategy serves multiple objectives.
Direct revenue extraction: IT services firms carry client billing data, financial records, and operational databases that represent ransom leverage.
Downstream access: MSPs and IT service providers maintain access to client environments. An operator who compromises an MSP inherits whatever remote access, credentials, and trust relationships the MSP holds with its clients. Spirals has not been confirmed to have exploited downstream client access from MSP victims, but the risk is structural to the targeting choice.
Cascading disruption: IT services organisations often support operational technology for their clients. Encryption of an MSP’s management infrastructure can disrupt the services they deliver to clients, creating downstream business impact beyond the direct victim.
Comparison to Known Groups
Spirals’ technical profile distinguishes it from the current ransomware ecosystem in two respects.
The IIS-focused initial access vector is uncommon. Most active groups in 2026 favour VPN exploitation (Fortinet, Cisco, Ivanti) or RDP credential abuse. IIS exploitation requires different tooling and knowledge, suggesting Spirals either represents a group with specific Windows web server expertise or a splinter from a larger operation that had developed IIS-specific capabilities.
The sub-24-hour encryption chain places Spirals in the faster tier of current ransomware operations. For comparison, incident reports for many larger RaaS groups document dwell times of 3-7 days between initial access and encryption. Groups that operate at the 24-hour end of the spectrum — Spirals, Akira in some observed intrusions — present a fundamentally different detection challenge.
Defender Guidance
IIS patching and hardening: Treat internet-facing IIS servers as high-priority patch targets. Apply all outstanding Windows Server and IIS security updates. Disable or restrict IIS management interface exposure. Review whether IIS WebDAV is enabled unnecessarily.
MSP access controls: Organisations that rely on managed service providers should review what remote access their MSPs hold. Require MFA on all MSP-managed accounts. Segment client systems so that MSP administrative access does not provide a single credential path to all clients.
Backup integrity: Given the speed of the Spirals encryption chain, offline and immutable backups are the primary recovery mechanism. Online backups connected to the network at the time of encryption will be encrypted. Verify that backup schedules ensure recent recovery points that cannot be reached by a ransomware encryptor.
Log file monitoring: The RECOVERY_SECTION.log ransom note naming convention specifically mimics operational log files. Alert on creation of .log files in unusual locations by unusual processes, and on bulk file modification events that indicate encryption activity rather than normal application writes.