Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems
Threat Actors
Malware Families
Excerpt
A newly identified ransomware family, Spirals, was used in a double-extortion attack against an IT services company in South Asia in June 2026. Researchers from Symantec’s Threat Hunter Team said the Rust-based malware was deployed less than 24 hours after attackers gained access to the victim’s network. The operation began with the compromise of an internet-facing Microsoft IIS web server . Attackers uploaded an ASP.NET web shell, giving them remote command execution through…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 4cab935d0ec400059a3fcdc95b6623efdd51a61dff401fba8d5da244cc2de649 | Medium | Score 45/100 | First seen |
| SHA256 | 0f9574dc38e5c34a31153f0bcc603c6ec29cb3bf65c3d25380dbe86d42573141 | Medium | Score 45/100 | First seen |
IOC Relationship Graph
Building graph…