Learn how Storm-2570 reuses RMM tools, Cloudflared, PsExec, and consistent TTPs across Qilin and DragonForce ransomware deployments

攻撃者がActive Directoryドメインコントローラーを標的にし、NTDS.dITデータベースに保存された認証情報を窃取するケースが増えています。 最近実施されたシミュレーションでは、脅威アクターがWindowsのネイティブ機能、リモート管理ツール、認証情報ダンプツールを組み合わせてActive Direct

Windows Latest found a registry workaround that stops Windows 11 from flattening your profile picture into static copies, letting animated GIFs and transparent PNGs display as-is. It requires editing locked AccountPicture keys as the SYSTEM account, not just as an administrator, using PsExec. The post Your Windows 11 profile picture can be an animated GIF, and it works in the Start menu and lock screen appeared first on Windows Latest

Ismael Valenzuela, Vice President of Labs, Threat Research and Intelligence at Arctic Wolf, sits down with Dave to discuss their work tracking Anubis. Arctic Wolf Labs details a series of 2026 Anubis ransomware intrusions, revealing affiliates using stolen VPN credentials and exploiting CitrixBleed 2 to gain initial access. Attackers then blended into legitimate IT activity by deploying RMM tools, using RDP and PsExec for lateral movement, stealing credentials, and establishing tunnels and proxies for persistence and exfiltration. The research highlights a repeatable attack chain defenders can disrupt before encryption, from suspicious remote access and unauthorized RMM deployment to credential theft, security-tool tampering, and ransomware execution. The research and executive brief can be found here: ⁠From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Play ransomware is using a familiar Windows-administration disguise to reduce suspicion during intrusions: a custom service binary named PSexesvc.exe.

Ransomware · IntelFusions threat intelligence

Playランサムウェアは、侵入活動中の不審感を軽減するために、Windows管理ツールを装う手口を使っています。具体的には、PSexesvc.exeという名前のカスタムサービスバイナリを利用しています。アンチウイルス&マルウェア 同グループがMicrosoft SysinternalsのPsExecを模倣した

Arctic Wolf says Anubis affiliates abused RMM tools, VPN logins, RDP, PsExec, and cloud-transfer tools before ransomware deployment.

INC Ransom abuses Citrix flaws, AnyDesk, PsExec, and living-off-the-land tools to target healthcare, industrial, and education sectors

GenieLocker is a custom ransomware family used by Toy Ghouls against Russian organizations, especially in manufacturing, with Windows, Linux, and ESXi variants active since March 2026. The group used stolen OpenVPN credentials for entry, deployed tools like Mimikatz and PsExec, and encrypted systems without evidence of data theft or double extortion. #GenieLocker #ToyGhouls #Bearlyfy #Labubu #Laboo.boo #Mimikatz #PsExec #OpenVPN

PsExec unter Windows sicher nutzen: Download, Syntax, Befehle remote ausführen, SYSTEM Konto, wichtige Parameter, typische Fehler und Lösungen.

Palo Alto GlobalProtectの認証回避脆弱性CVE-2026-0257がQilinランサムウェアの展開に悪用されている件を、Arctic Wolf Labsの解析を基に解説。初期侵入からLSASS/NTDS認証情報窃取、PsExecによる横展開、MEGAへのデータ持ち出し、ドメイン全域の暗号化に至る攻撃連鎖と、情報システム部門が取るべき対策をまとめました。

Arctic Wolf Labs found multiple June 2026 intrusions in which attackers used CVE-2026-0257 against Palo Alto Networks firewall appliances to gain VPN access and quickly deploy Qilin ransomware across victim networks. The activity showed shared operational patterns, including PsExec lateral movement, credential theft, log clearing, and in some cases data exfiltration for double-extortion, suggesting overlapping Qilin affiliates or shared exploitation infrastructure. #CVE-2026-0257 #PaloAltoNetworks #Qilin #GlobalProtect #PsExec

A previously unknown ransomware operation compromised a South Asian IT services company and began deploying its encryptor across the network less than 24 hours after the initial breach. The attackers entered through an internet-facing Microsoft IIS server, installed an ASP.NET web shell, and created several remote-access channels. They later used WMI and PsExec to move […] The post New Spirals Ransomware Encrypts IT Firm in Under 24 Hours appeared first on VPN Central.

A previously unseen ransomware family dubbed "Spirals" struck an IT services company in South Asia in June 2026. Symantec's Threat Hunter Team reports that the attackers moved from the initial breach to full network encryption in under 24 hours.

A previously unseen ransomware family dubbed "Spirals" struck an IT services company in South Asia in June 2026. Symantec's Threat Hunter Team reports that the attackers moved from the initial breach ...

A previously unseen ransomware family dubbed “Spirals” struck an IT services company in South Asia in June 2026. Symantec’s Threat Hunter Team reports that the attackers moved from the initial breach to full network encryption in under 24 hours. The Rust-based payload appears to be either entirely new or purpose-built for this single targeted attack, and the threat actor behind the operation remains unidentified. Spirals Ransomware Uses IIS Web Shell and PsExec The intrusion began on June 16 at 22:21 local time when the attackers compromised an internet-facing IIS web server and uploaded an ASP.NET web shell. Within minutes, they deployed three separate tunneling tools, including Chisel (disguised as chrome.exe ) and a Cloudflare tunnel client establishing redundant, covert communication channels. A token impersonation tool followed shortly after, which likely enabled privilege escalation. During a concentrated three-hour hands-on-keyboard session, the operator spawned cmd.exe and powershell.exe through the IIS worker process, performed a User Account Control (UAC) bypass, enabled Remote Desktop Protocol (RDP), created a persistent local account, and dumped the SAM hive. By 23:07, initial precursor activity showed active attempts to disable security tools. As detailed in the Spirals ransomware report , the attackers pivoted to WMI-based lateral movement at 23:33. They successfully hit over a dozen machines within minutes using compromised domain administrator credentials a rapid cadence strongly suggesting automated, pre-planned targeting rather than manual exploration. On June 17, the attackers shifted their tactics to using PsExec as their primary mass deployment vector. Starting around 14:12, a single compromised host pushed an identical base64-encoded PowerShell payload to network targets every few seconds for roughly 30 minutes. Managing compromised administrative tools inside a network mirrors the persistent perimeter struggles defenders face when managing SharePoint flaws exploited by opportunistic actors. This automated payload immediately disabled Windows Defender’s real-time monitoring and forcibly stopped over 20 critical backup, database, and virtualization services, including Veeam, VMware, SQL Server, and Exchange, effectively clearing open file handles ahead of encryption. The ransomware executable itself was named bitsadmin.exe to masquerade as a legitimate Windows utility. It was staged across multiple network locations, including the SYSVOL domain scripts directory, ensuring automated propagation even to machines not directly targeted by the PsExec script. This staging technique underscores why enterprise groups must audit internal script shares, much like they audit systems against archiving tool exploits that drop disguised binaries into legitimate directory trees. Spirals functions as a full-featured, Rust-based encryptor built with defense evasion, automated lateral movement, process termination, and privilege escalation capabilities. Cryptographic Component Implementation Specification Target Objective Symmetric Key Per-file AES-128 Secures the raw block data of targeted files Asymmetric Wrapper Attacker-controlled ECDH P-256 public key Protects the local AES keys from decryption Optimization Trick Intermittent encryption of jittered chunks Speeds up the locking cycle for files over 5 MB The ransomware leaves a local footprint to force negotiation: The ransom note is dropped across the system as C:\RECOVERY_SECTION.log . It threatens the public leak of stolen corporate data within six days if the target fails to pay. The note directs victims to a Tor negotiation portal, which Symantec confirmed explicitly names the threat family as “Spirals”. While Spirals has only been observed against a single victim so far, its operational discipline signals a highly skilled actor capable of rapidly scaling attacks. The combination of layered tunneling infrastructure, credential harvesting via LSASS dumps (using rundll32.exe and comsvcs.dll ), and domain-wide propagation via SYSVOL requires an immediate defensive response. Symantec’s indicator list includes dedicated staging infrastructure hosted at 185.141.216.194 alongside two compromised domains used for hosting malicious payloads. Organizations running internet-facing IIS servers should enforce the following priorities: Web Shell Detection: Actively monitor internet-facing web servers for unauthenticated ASP.NET file modifications or sudden process creations originating from IIS worker loops. Behavioral Auditing: Set immediate alerts on anomalous WMI and PsExec activity executing rapid, sequential connection attempts across internal zones. Credential Protection: Harden endpoints against LSASS memory dumping tools and tightly restrict domain administrator account usage on non-domain controllers.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post New Spirals Ransomware Uses IIS Web Shell and PsExec to Encrypt IT Firm in Under 24 Hours appeared first on Cyber Security News .