NightSpire Ransomware Evolves: Updated Techniques and Detection Tips

Summary

NightSpire is a ransomware family that appears to operate under a Ransomware-as-a-Service style delivery model. Rather than leaning heavily on built-in living-off-the-land binaries, the operators routinely bring in third-party utilities for persistence, data staging, and exfiltration, indicating hands-on activity. Incidents have been observed from early 2025 through March 2026 and typically involve manual deployment of tools by the attacker. Common indicators include bespoke encryptor binaries, the .nspire file extension on encrypted data, and ransom notes that follow consistent naming patterns.

Investigation

Huntress investigators reported attacker access through RDP, followed by installation of Chrome Remote Desktop to maintain interactive control. The intruders then used tools such as Everything, 7-Zip, and MEGASync to identify valuable data, package it for staging, and exfiltrate it. In later steps, additional software including VMware Workstation and WPS Office was introduced on the host. Persistence traces were identified across multiple endpoints, and the NightSpire encryptor (enc.exe) appeared with different SHA-256 values across separate incidents, suggesting per-operation builds or repacking.

Mitigation

Monitor for unauthorized remote-access tooling (especially new RDP-adjacent utilities and Chrome Remote Desktop), unusual installation of third-party archivers or sync clients, and creation of files ending in .nspire. Reduce exposure by blocking execution of unknown binaries and tightening least-privilege controls around remote access. Maintain regular backups and ensure Volume Shadow Copy protections are in place to prevent destructive tampering.

Response

If NightSpire activity is suspected, isolate impacted systems, preserve forensic evidence of installed utilities and the ransomware payload, and terminate active remote desktop sessions. Restore from verified clean backups and confirm the encryptor is fully removed. Hunt enterprise-wide for the same toolset and related artifacts, then update detection content to catch repeat patterns and adjacent operator behavior.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The simulated attacker has gained initial access and now initiates the ransomware payload. The payload encrypts a target file, renames it with the “.nspire” extension, and drops a ransom‑note in the same directory. The attacker uses built‑in PowerShell cmdlets to avoid writing additional binaries, mimicking a living‑off‑the‑land approach.

  1. Select a target file (e.g., a dummy document).
  2. Encrypt the file using a simple XOR routine (representative of ransomware encryption).
  3. Rename the encrypted file so that its name ends with “.nspire”.
  4. Create a ransom‑note named _nightspire_readme.txt containing ransom instructions.

• Regression Test Script: The following PowerShell script reproduces the steps above and generates the exact telemetry the Sigma rule watches for.

  # NightSpire ransomware simulation – generates .nspire files and ransom notes
  param(
      [string]$TargetFolder = "$env:USERPROFILEDesktopNightSpireDemo"
  )
  
  # 1. Prepare demo folder
  New-Item -ItemType Directory -Path $TargetFolder -Force | Out-Null
  
  # 2. Create a dummy victim file
  $victimPath = Join-Path $TargetFolder "victim_document.txt"
  "This is a sample document that will be 'encrypted'." | Set-Content -Path $victimPath -Encoding UTF8
  
  # 3. Simple XOR "encryption" (for demo purposes only)
  $key = 0x5A
  $bytes = [System.IO.File]::ReadAllBytes($victimPath)
  for ($i = 0; $i -lt $bytes.Length; $i++) {
      $bytes[$i] = $bytes[$i] -bxor $key
  }
  $encPath = Join-Path $TargetFolder "victim_document.nspire"
  [System.IO.File]::WriteAllBytes($encPath, $bytes)
  
  # 4. Remove original plaintext
  Remove-Item -Path $victimPath -Force
  
  # 5. Drop ransom note (one of the two names the rule detects)
  $notePath = Join-Path $TargetFolder "_nightspire_readme.txt"
  @"
  Your files have been encrypted by NightSpire ransomware.
  To restore your data, send 2 BTC to the address below.
  "@ | Set-Content -Path $notePath -Encoding UTF8
  
  Write-Host "Simulation complete. Files created:"
  Write-Host " - $encPath"
  Write-Host " - $notePath"

• Cleanup Commands: Remove all artifacts after verification.

  # Cleanup NightSpire simulation artifacts
  $demoFolder = "$env:USERPROFILEDesktopNightSpireDemo"
  if (Test-Path $demoFolder) {
      Remove-Item -Path $demoFolder -Recurse -Force
      Write-Host "Demo folder removed."
  } else {
      Write-Host "No demo artifacts found."
  }