NightSpire Ransomware Recovery: .nspire Files, Databases and VMs

NightSpire is a double-extortion ransomware group active since early 2025, and one of the busiest of 2026: ransomware.live lists more than 360 claimed victims, with new names added every week. It steals data first, publishes victims on its leak site and has been reported giving deadlines as short as two days before the data is released.

Encrypted files get the .nspire extension and a ransom note named readme.txt is dropped in each affected folder. The encryptor is written in Go.

Public reporting names CVE-2024-55591, an authentication bypass in Fortinet FortiOS and FortiProxy, as the main way in, alongside brute-forced or stolen VPN and RDP logins. Once inside, the operators use ordinary admin tools rather than custom malware: WinSCP, Rclone and MEGA to move data out, 7-Zip to package it, and AnyDesk or Chrome Remote Desktop to keep access.

AhnLab's analysis of the encryptor found that NightSpire does not encrypt every file the same way. For ISO, VHDX, VMDK, ZIP, VIB, BAK, MDF and LDF files it uses block encryption in 1 MB units; other files are encrypted fully. Each file has its own AES key, protected with the attacker's RSA key.

That list is exactly the files a business cares about most: VMware and Hyper-V virtual disks, Veeam backup increments, and SQL Server databases and backups. Encrypting them in blocks is faster for the attacker, and it means the data between and around the encrypted blocks is untouched. In a SQL Server MDF, the pages that were not hit still hold complete rows; in a VMDK, most of the file systems and files inside the virtual disk can usually still be read.

We work directly from the encrypted files, without the attacker's key: we measure which parts of each file were encrypted, then rebuild the database tables, the virtual machine disks and the backup contents from the parts that were not. We have solved many cases like this across SQL Server, Oracle, VMware, Hyper-V and Veeam.

What helps most is what you do in the first hours. Do not delete the .nspire files, do not reformat the datastore or the backup repository, and do not run random decryptors found online against the only copy. Take a copy or image of the affected files and contact us for a free assessment: we tell you exactly what is recoverable before you pay anything.