Spirals ransomware has claimed the compromise of GCC-based maritime services provider Seven Seas Group, demanding ransom under a strict data leak countdown. This incident underscores critical risks across regional logistics and transportation infrastructure.
Seven Seas Group, a prominent maritime services and logistics provider headquartered in the United Arab Emirates, has been listed on the dark web leak portal of the Spirals ransomware operation. The threat actors claim to have exfiltrated sensitive corporate data and established a six-to-seven-day ultimatum before publishing the stolen records. This incident marks the second major extortion event for the organization, following an earlier compromise attributed to Snatch ransomware in March 2024.
The extortion listing surfaced on the dedicated Tor portal maintained by the Spirals ransomware syndicate. According to the listing, the operators gained unauthorized access to internal infrastructure, exfiltrated corporate records, and initiated a countdown for public release. The targeting of maritime and logistics supply chain entities across the Gulf Cooperation Council (GCC) highlights growing adversary interest in critical transport nodes.
Maritime service providers manage sensitive documentation including vessel manifests, customs filings, supplier contracts, financial transactions, and employee identification records. When cybercriminals breach these environments, the operational and regulatory fallout can quickly cascade across regional trade partners. Organizations operating across transport and industrial verticals require proactive Penetration Testing to identify perimeter flaws before threat actors weaponize them.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
ASP.NET web shell via IIS (w3wp.exe)
Chisel, Cloudflare, revsocks, tunn.exe
LSASS dump (comsvcs.dll), SAM extraction
Defender wiped, 23 backup services killed
Rust encryptor deployed via SYSVOL
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
October 5, 2026
Panzer ransomware has targeted UK healthcare provider SMCare, exfiltrating 33GB of sensitive organizational data. The double-extortion campaign leverages cross-platform payloads capable of targeting Windows and VMware ESXi environments, enforcing strict countdown timers on dedicated Tor leak sites.
September 9, 2026
The Vexy ransomware group has published an extortion listing targeting Argentinian retailer Librería Santa Fe, claiming 24.2 GB of exfiltrated data with a 20-day publication ultimatum. Explore technical analysis, attack chains, and defensive containment strategies.
September 23, 2026
Dark Project ransomware operators have listed a US industrial machinery distributor on their dark web portal, threatening to leak 115 GB of proprietary project drawings, customer databases, and financial files following an aggressive extortion countdown.
This original source is hosted on the Tor network. Use Tor Browser to open it, and treat the forum as untrusted while reviewing the post.
Onion URL
http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion/
The Spirals ransomware group is an emerging threat syndicate that surfaced in mid-2026, known for targeting commercial enterprises, logistics hubs, and IT service providers across the Middle East and Asia. While the group operates independently with custom Rust-compiled payloads, their operational playbooks show tactical overlap with advanced initial access brokers and double-extortion syndicates.
The group relies heavily on dedicated Tor negotiation infrastructure to manage extortion demands. By leveraging modular living-off-the-land techniques, common open-source tunneling utilities, and commodity remote access binaries, Spirals maintains low operational overhead while achieving devastating speed inside compromised enterprise networks.
Spirals is an aggressive double-extortion ransomware strain engineered in Rust, designed to execute rapid intrusions from initial compromise to domain-wide encryption in under twenty-four hours. Threat researchers have observed an organized, multi-stage attack lifecycle that systematically dismantles defenses and accelerates data exfiltration.
Intrusions attributed to Spirals frequently start by exploiting internet-facing Microsoft IIS web servers. Adversaries identify exposed file upload vulnerabilities or unpatched application flaws to plant ASP.NET web shells within public web directories. Once execution is established under the IIS worker process (w3wp.exe), the attackers launch interactive shells using command-line interpreters such as cmd.exe or PowerShell.
Within minutes of initial access, operators establish redundant persistence and bypass network boundaries using custom and open-source proxy tooling. Observed binaries include:
Cloudflare Tunnels: Executed via cloudflared-windows-amd64.exe to route inbound administrative traffic over encrypted outbound HTTPS sessions.
Chisel Masquerading: Dropped under names like chrome.exe in scheduled task directories to establish reverse SOCKS tunnels.
Custom Tunneling Utilities: Executables such as tunn.exe and revsocks.exe staged in temporary and public user directories.
Rogue Local Accounts: Creating local administrative accounts and enabling Remote Desktop Protocol (RDP) for direct access.
To navigate the Windows Active Directory domain, the operators execute memory dumps of the Local Security Authority Subsystem Service (LSASS) using built-in system libraries like rundll32.exe comsvcs.dll, #24. They also extract Security Account Manager (SAM) registry hives into encrypted staging archives. Using captured administrative credentials and token impersonation tools (tokens.exe), the attackers move laterally across domain controllers and core database servers via Windows Management Instrumentation (WMI) and PsExec.
Before launching the final encryption routine, the threat group deploys heavily obfuscated, Base64-encoded PowerShell scripts under the SYSTEM context. These scripts forcefully terminate endpoint protections and administrative services:
Disabling Microsoft Defender antivirus features and purging virus definition signatures.
Stopping and deleting volume shadow copies (VSS) to prevent point-in-time recovery.
Force-terminating critical virtualization, database, and backup processes including Veeam, VMware, Hyper-V, Microsoft SQL Server, Oracle, PostgreSQL, and Microsoft Exchange.
The ransomware payload is frequently disguised as bitsadmin.exe or vbr2116.exe and placed into Active Directory distribution shares such as SYSVOL\domain\scripts for automated enterprise deployment. The Rust-based encryptor utilizes AES-128 encryption paired with elliptic-curve Diffie-Hellman (ECDH P-256) public-key wrapping. To maximize execution speed, the payload applies intermittent encryption on files larger than 5 MB, leaving a ransom note titled C:\RECOVERY_SECTION.log across encrypted systems.
Double-extortion attacks pose severe risks that extend beyond operational interruption. When critical maritime and logistics operators experience ransomware events, the business impacts are multifaceted:
Operational Disruption: Loss of access to enterprise resource planning (ERP) systems, inventory records, and vessel dispatch databases can delay port operations and cargo processing.
Supply Chain Exposure: Exfiltrated commercial contracts, customer registries, and customs declarations can expose third-party shipping partners to secondary phishing or extortion.
Regulatory and Compliance Liabilities: Organizations handling personal and corporate data within the GCC must navigate stringent data protection mandates, where breaches may trigger mandatory disclosure requirements and regulatory scrutiny.
Reputational Damage: Repeated ransomware disclosures undermine partner trust and complicate enterprise contract renewals.
Continuous threat intelligence and proactive Vulnerability Assessments are essential to verify that internet-facing applications do not serve as unmonitored entry pathways for automated exploit scripts.
Security operations teams should implement targeted behavioral detections and strict infrastructure hardening to identify and contain Spirals intrusions during early stages.
Configure endpoint detection and response (EDR) rules to flag abnormal parent-child process relationships and credential access attempts:
Monitor IIS worker processes (w3wp.exe) spawning command shells (cmd.exe, powershell.exe) or download utilities (certutil.exe).
Alert on invocations of rundll32.exe loading comsvcs.dll with command-line arguments referencing MiniDump.
Detect mass service stop commands directed at backup and database engines (e.g., net stop "Veeam" or sc stop "MSSQL").
Enable Microsoft Defender Tamper Protection and enforce LSA Protection (RunAsPPL=1) to shield LSASS memory.
Restrict adversary communication channels by auditing network perimeters and outbound traffic:
Block unauthorized outbound tunneling protocols, including unregistered Cloudflare Tunnel instances and unauthorized SOCKS5 proxy endpoints.
Enforce strict egress filtering from server subnets, restricting web servers from initiating arbitrary outbound TCP connections.
Audit Domain Controller shares, particularly SYSVOL\domain\scripts, restricting write permissions to verified Domain Administrators and monitoring file integrity.
Ensure business continuity by decoupling backup environments from primary Active Directory authentication domains. Store secondary copies on immutable, write-once-read-many (WORM) storage or dedicated offline arrays that cannot be wiped by compromised domain administrative accounts.
