A newly documented ransomware family called Spirals moved from initial access to network-wide encryption in less than 24 hours, hitting an IT services company in South Asia. The attack started with a compromised internet-facing Microsoft IIS server and ended with encrypted files across more than a dozen systems.
The speed is alarming. But every phase of this attack involved Windows file system operations that could have been blocked before any damage occurred.
The Web Shell Had to Land on Disk First
The attackers compromised the IIS server and uploaded an ASP.NET web shell. That web shell is a file. It had to be written to disk by the IIS worker process before it could be used.
IIS worker processes (w3wp.exe) serve web pages. They read HTML, CSS, JavaScript, and image files. They do not normally write executable payloads or script files to the web server directory.
FileSure operates at the Windows kernel level via a filter driver. It intercepts every file operation — open, read, write, delete, create, rename — before the operation completes. You define a policy: w3wp.exe cannot write .aspx, .asp, .exe, .dll, or .bat files to the web server directory.
The attacker uploads the web shell. The IIS process attempts to write the .aspx file. FileSure intercepts the write operation, checks it against the policy, and blocks it. The web shell never lands. The attacker never gets a foothold. Everything downstream — credential dumping, lateral movement, bulk encryption — never happens.
Specific FileSure rule configuration:
- Program name filter: w3wp.exe (IIS worker process)
- File name filter: *.aspx, *.asp, *.exe, *.dll, *.bat
- Operations: Write, Create
- Path filter: C:\inetpub\wwwroot\ (or your web server root)
- Action: Block
Result: Normal web server operations (reading and serving existing files) continue without interruption. Unauthorized payload writes are blocked and logged.
Lateral Movement and Ransomware Deployment Were File Operations Too
After establishing access, the attackers used Windows Management Instrumentation (WMI) to move laterally and PsExec to deploy the ransomware payload with SYSTEM privileges. Both techniques require writing files to remote systems via SMB.
PsExec works by copying an executable to the ADMIN$ share on the target machine and creating a service to run it. That’s a file write operation to a network share, followed by writing a service binary. FileSure controls both.
The ransomware payload itself — disguised as bitsadmin.exe — had to be written to each target system before it could execute. Block the write, and the payload never lands. No execution, no encryption.
Bulk Encryption Triggers Threshold Detection
Even if an attacker bypasses prevention controls and ransomware begins executing, FileSure’s threshold rules detect and stop bulk encryption.
The article notes that Spirals uses AES-128 encryption and processes files larger than 5 MB in chunks to speed up encryption. That means hundreds of write and rename operations per minute (ransomware typically renames files after encrypting them).
Threshold rule configuration:
- File name filter: * (all files)
- Operations: Write, Rename/Move
- Drive type: Hard drives, Network drives
- Threshold: 20 matches within 60 minutes
- Action: Block subsequent operations after threshold is reached
Normal users save files throughout the day, but rarely exceed 20 file modifications per hour. Ransomware encryption crosses that threshold within seconds. Once the threshold fires, further write and rename operations are blocked. Damage is contained to the small number of files modified before detection.
The 24-Hour Window Doesn’t Matter If the First Step Fails
The article frames the incident as a wake-up call because the response window is now measured in hours instead of days. That’s true if you’re relying on detection and response.
But if you block the web shell write at the IIS server, there’s no credential theft to detect, no lateral movement to investigate, and no encryption to respond to. The attack stops at step one.
FileSure doesn’t chase attack signatures or wait for threat intelligence updates. It enforces file operation policies at the kernel level. A ransomware variant that appeared this morning is stopped the same way as one from five years ago, because the mechanism — controlling what programs can write to your file system — doesn’t depend on recognizing the threat.
Ready to see how it works in your environment? Start your free 21-day trial at bystorm.com — 1 server, 10 workstations, full functionality, no credit card required.
Source: New Spirals ransomware can lock down an entire network in under 24 hours
Category: Ransomware
Tags: spirals ransomware, web shell, iis security, lateral movement, kernel filter driver, file system security, threshold detection, psexec
