Spirals
New Group | Active
This is an emerging group, so claims should be treated with caution until independently verified.
None
Victims
2
First Victim
2026-09-18
(est. attack date)
Discovery Date
2026-09-18
Last Seen
2026-09-18
Inactive Since
4
days
Avg Delay
N/A
attack→claim
Infostealer
50.0%
victims with domain
Countries
1
hit
Uptime
97.8% avg (30d)
Attack Velocity — Last 12 months (based on attack estimated date if available)
2 victims this month
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
SPIRALS | Yes | 2026-09-22T14:21:50 |
spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion
|
Target
Top 5 Activity Sectors
- Healthcare 1
- Technology 1
Top 5 Countries
-
United States
1
Heatmap
KQL Query (3)
-
IIS Worker Process Spawning Shell (Web Shell Initial Access)
Initial Access
Sentinel
T1505.003 -
PsExec-Based Lateral Movement
Lateral Movement
Sentinel
T1021.002 -
Rapid Mass File Modification Burst (Sub-24h Encryption)
Encryption / Impact
Sentinel
T1486
Victims (2)
Certified IT Asset Disposition (ITAD) and e-waste management for federal agencies, defense contracto…