Hackers Breached an IIS Server and Deployed Ransomware Across the Network the Next Day

Hackers leveraged a compromised Microsoft IIS server to gain initial access and deploy a previously unseen ransomware payload across an enterprise network within 24 hours, highlighting a highly coordinated and operationally mature intrusion chain observed in June 2026.

The campaign reflects a fast-paced, hands-on-keyboard intrusion combined with automated lateral movement, signaling a threat actor capable of scaling operations beyond a single victim.

The intrusion began with the compromise of an internet-facing IIS server, where attackers uploaded an ASP.NET web shell to establish foothold.

Within a three-hour window, operators executed commands through the IIS worker process, spawning cmd.exe and PowerShell to conduct reconnaissance and system manipulation.

They performed a User Account Control bypass to elevate privileges, enabled Remote Desktop Protocol, and created a local persistence account.

Defense evasion occurred early in the attack lifecycle. Endpoint security tools were targeted using native utilities such as wmic and MpCmdRun.exe.

Credential access was achieved by dumping the Security Account Manager hive into a protected archive, followed by LSASS memory dumping via rundll32.exe and comsvcs.dll during lateral movement.

This dual-stage credential harvesting enabled both immediate and scalable access across the domain.

To maintain resilient command-and-control, attackers deployed multiple tunneling mechanisms including revsocks (reverse SOCKS proxy), Chisel (renamed as chrome.exe), and a Cloudflare Tunnel client.

These tools established redundant encrypted channels over port 443, effectively bypassing network controls. Payload delivery infrastructure included external IP-hosted resources and staging domains, with some files disguised using .jpg extensions to evade detection.

According to Symantec Threat Hunter Team findings, the attack targeted an IT services organization in South Asia and culminated in the deployment of a new Rust-based ransomware family dubbed “Spirals.”

Lateral movement began the same night using Windows Management Instrumentation, targeting numerous systems in rapid succession using likely domain administrator credentials.

IIS Server Breached

The speed and breadth of this activity suggest pre-enumeration of Active Directory assets. By the following day, attackers transitioned to PsExec for mass deployment, executing a base64-encoded PowerShell payload across dozens of machines per minute.

This payload first disabled Microsoft Defender protections, then terminated services associated with backup, virtualization, and database platforms including VMware, Veeam, SQL Server, Oracle, and SAP.

This step ensured file accessibility prior to encryption, a hallmark of modern ransomware operations.

The Spirals ransomware payload, masquerading as bitsadmin.exe, was distributed across multiple strategic locations including the Windows directory, user desktops, SYSVOL domain scripts, and network shares hosted on domain controllers.

This placement enabled both direct execution and propagation via domain replication mechanisms.

Encryption was performed using per-file AES-128 keys secured with an ECDH P-256 public key, ensuring strong cryptographic isolation.

For performance optimization, files larger than 5 MB were encrypted intermittently using chunk-based techniques.

The ransomware also incorporated process termination, obfuscation, and privilege escalation capabilities, indicating a fully featured and mature codebase.

A ransom note was written to C:\RECOVERY_SECTION.log, directing victims to a Tor-based negotiation portal and threatening data leakage within six days, confirming a double extortion model.

Investigators identified an associated onion site referencing the “Spirals” branding, although attribution remains unknown.

Notably, the attackers staged multiple tunneling binaries in directories consistent with IIS web application paths and Windows scheduled tasks, blending malicious artifacts with legitimate operational structures.

Tools such as tunn.exe, revsocks.exe, and cloudflared-windows-amd64.exe were strategically placed to evade detection and maintain persistence.

Despite being observed in a single incident so far, the operational discipline, speed of execution, and layered evasion techniques strongly indicate a threat actor capable of conducting broader campaigns.

The combination of IIS exploitation, rapid privilege escalation, automated lateral movement, and enterprise-wide ransomware deployment underscores a growing trend toward highly compressed attack timelines.

Organizations exposing IIS servers to the internet should treat this incident as a critical warning, particularly given the attackers’ ability to transition from initial access to full domain compromise in under a day.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide