A recent incident highlights a new ransomware family, Spirals, that appears to have hit an IT services firm. The attackers reportedly used an IIS web shell to gain initial access and PsExec to move laterally, encrypting endpoints in a matter of hours. This is a reminder that fast-moving ransomware can target smaller teams and service providers just as effectively as larger enterprises.
What happened
According to industry reports, the incident involved a targeted IT services company that experienced rapid encryption across multiple devices. The attackers reportedly leveraged a Web server component (IIS) to deploy a web shell, enabling attackers to run commands on a server. They then used a legitimate remote administration tool to reach other machines and encrypt them. While details are still unfolding, the pattern—web shells followed by lateral movement—is a known tactic used by several ransomware families and can lead to quick, disruptive downtime for a business.
Why it matters
- Small businesses and service providers can be high-value targets due to mixed environments and time-sensitive client work.
- Traditional defenses may miss post-exploitation activity if quick lateral movement isn’t monitored. Lateral movement tools like PsExec are legitimate in many contexts, which makes detection harder unless you actively monitor for unusual usage.
- Plainly, uptime matters. Ransomware waves that encrypt endpoints fast can force costly downtime and data recovery efforts.
Practical steps you can take
- Verify backups and test restore procedures offline. Ensure you can recover data without paying a ransom and that backups aren’t compromised by the same attack.
- Isolate affected systems quickly to stop lateral movement and prevent further encryption.
- Limit and audit remote administration tools. Disable unnecessary remote tools, and enable strict logging and alerting for tools like PsExec.
- Harden IIS and web-facing components. Apply the latest patches, disable unused modules, and consider a Web Application Firewall to block suspicious requests.
- Enforce multi-factor authentication and strong access controls to reduce the risk of initial access via stolen credentials.
- Review incident response plans. Update playbooks, confirm contact paths, and practice quick decision-making during an incident.
- Increase security awareness. Train staff to recognize phishing attempts and suspicious links that could lead to initial access.
Final thought: ransomware threats continue to evolve, but a prepared defense posture—backups, network segmentation, and vigilant monitoring—helps you stay in control. If you run a small business or manage IT for clients, start with a quick security-health check and tighten controls on remote access today. For more guidance, consult trusted security advisories and ensure your recovery plans are practical and tested.