Skip to content

Back to the catalog

Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
huntress.comwriteup

Decoding NightSpire: Ransomware IOCs Aren't Set in Stone

Huntress details two NightSpire ransomware incidents (December 2025 and March 2026) it responded to, showing how the threat actor's tooling and TTPs differed markedly between attacks despite the same ransomware family. In the March 2026 case the attacker used RDP for initial access, then Chrome Remote Desktop and AnyDesk for persistence, Everything and 7-Zip for data staging, MEGASync for exfiltration, and VMware Workstation/WPS Office for other purposes — none of it relying on native LOLBins like WMI or PsExec seen in public NightSpire reporting. The piece argues that because ransomware like NightSpire (and RaaS families such as Akira and Sodinokibi) may be run by shifting affiliates, IOCs and TTP clusters attributed to "the group" often aren't consistent across incidents.

TL;DR Huntress DFIR breakdown of two NightSpire ransomware incidents shows wildly different tooling/TTPs between attacks, illustrating why ransomware IOCs tied to a "group" name can be unreliable under RaaS affiliate models.
Open original ↗
Document

What it is

Two NightSpire ransomware intrusions investigated by Huntress via their endpoint agent. NightSpire (first seen February 2025) encrypts files with a .nspire extension and drops a _nigh... ransom note. The intrusions relied entirely on legitimate, freely-available software rather than custom malware for their pre-encryption stages.

How it works

In the March 2026 incident, the Huntress agent was installed after the intrusion was underway — footholds were detected almost immediately, indicating the actor was already resident. Reconstructed via process lineage, the observed sequence on the first endpoint was:

flowchart LR
  A[RDP access] --> B[Chrome Remote Desktop]
  B --> C[Everything file search]
  C --> D[MEGASync exfil]
  D --> E[VMware Workstation]
  E --> F[Everything: browse files]
  F --> G[7Zip: archive folder]
  G --> H[WPS Office]
  H --> I[NightSpire encryptor]

A second endpoint showed matching foothold signals for Chrome Remote Desktop and AnyDesk. The page's broader argument: because RaaS affiliates rotate tooling, distinct attack clusters emerge over time even under one ransomware name — so static IOC lists age quickly. It also notes RaaS encryptors often embed process-kill / recovery-inhibit commands (e.g., Akira spawning PowerShell to delete Volume Shadow Copies; 2020 Sodinokibi samples carrying 156 embedded termination commands).

Preconditions / Affected

Initial access here was via RDP with credentials the actor already held. The tooling (Chrome Remote Desktop, AnyDesk, Everything, MEGASync, VMware Workstation, WPS Office, 7Zip) is legitimate and unlikely to trip signature-based AV — the signal is behavioral: these tools appearing in sequence on a server, installed by an interactive remote session.

What to do

The page gives no patches or commands. The actionable takeaway is detection posture:

  • Alert on install/execution of remote-access tools (Chrome Remote Desktop, AnyDesk) and MEGASync on endpoints where they have no business reason.
  • Treat Everything → 7Zip (archiving a specific folder) → MEGASync as a staging-and-exfil chain worth investigating.
  • Do not treat any single published NightSpire IOC set as complete or current; cluster on behavior across your customer base instead.

Caveats

  • The ransom note's claim of "2.5TB" exfiltrated is explicitly unverified — Huntress confirmed the actor ran Everything, 7Zip, and MEGASync and viewed some files, but has no evidence of the volume or contents taken.
  • Whether NightSpire is RaaS is disputed: Halcyon (July 2025) called it "a closed shop" with no affiliate program; HivePro (two months later) described a RaaS model. Huntress suggests this reflects evolution over time rather than one party being wrong — reinforcing why the IOCs shift.
  • The earlier Huntress incident yielded little TTP data beyond the .nspire extension and ransom note.

Organisations named here

  • Halcyon
  • HivePro
  • LOLBins

Technologies named here

  • Chrome Remote Desktop
  • Everything
  • MEGASync
  • VMware Workstation
  • 7-Zip
  • WPS Office
  • AnyDesk
  • WMI
  • PsExec
  • Huntress agent
  • Huntress
  • RDP

Techniques named here

  • Ransomware-as-a-Service affiliate model
  • Volume Shadow Copy deletion
  • Embedded process/service termination commands
  • Initial access via RDP
  • Persistence via remote access tools
  • File discovery/collection via Everything
  • Data archiving via 7Zip
  • Data exfiltration via MEGASync
  • Use of native utilities/LOLBins
  • Ransom note deployment with file extension change

Threat actors named here

  • NightSpire
  • Akira
  • Sodinokibi

Related in Threat Intel