Spirals Ransomware Recovery: What's Recoverable

Spirals is a ransomware family first described by Symantec in July 2026, after a double-extortion attack in June 2026 on an IT services company in South Asia. A leak site under the same name began listing victims in September 2026. Symantec has not attributed the operation to a known group.

The attackers broke in through a public IIS web server, where they planted an ASP.NET web shell. They dumped credentials from the SAM registry hive and LSASS memory, moved to more than a dozen systems with WMI and PsExec, and kept several back doors open through revsocks, Chisel and Cloudflare tunnels. From the first access to stolen data and encrypted systems took less than 24 hours.

Before encrypting, a PowerShell script switched off Microsoft Defender and stopped the services of 23 backup, database and virtualisation products, Veeam, VMware, Hyper-V, SQL Server, Oracle and PostgreSQL among them. Stopping these services is what lets ransomware encrypt database and backup files that would otherwise be locked. The ransom note is written to C:\RECOVERY_SECTION.log and threatens publication of the stolen data within six days.

The encryptor is written in Rust and disguised as bitsadmin.exe. Each file gets its own AES-128 key, protected with the attacker's ECDH P-256 public key, so the encryption cannot be broken. But, according to Symantec, files larger than 5 MB are encrypted intermittently: only parts of them.

That is the important point for recovery. Databases, virtual disks and backup files are far larger than 5 MB, so after a Spirals attack their unencrypted parts still hold real data. How much exactly has to be measured on the files; the rows, blocks and files in the untouched parts can then be recovered without the key.

Isolate the affected systems, but do not wipe, reinstall or "clean" anything yet, and do not run decryptors found online on your only copy. Keep the ransom note, a few encrypted files and, if you have them, unencrypted copies of the same files from before the attack: comparing the two shows exactly how the files were encrypted.

Then establish what is recoverable before deciding anything else: how much of each database, virtual disk and backup file was encrypted, and what the untouched parts still hold. Large files are often only partly encrypted, and that is where recovery without the key comes from.