Nightspire is a ransomware group responsible for infecting 369 victims across 55 countries in sectors including manufacturing, healthcare, technology, with aggressive tactics like double extortion and tight ransom deadlines.
Who Nightspire is
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Recorded activity
Disclosures attributed to Nightspire in this database run from March 2025 to October 2026, totalling 369 victims — 1.6% of everything tracked here. Nightspire has listed victims in 55 countries in this database, most often United States, followed by Turkey and India. The sectors appearing most in its listings are Manufacturing, Healthcare, Technology.
How Nightspire is documented to operate
Valid Accounts
T1078
Stealth
Persistence
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.
Mitigations:
Application Developer Guidance, User Training, Password Policies, User Account Management, Privileged Account Management, Multi-factor Authentication
MITRE ATT&CK reference
Brute Force
T1110
Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach.
Mitigations:
Password Policies, User Account Management, Multi-factor Authentication, Account Use Policies
MITRE ATT&CK reference
Exploit Public-Facing Application
T1190
Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets. On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.
Mitigations:
Vulnerability Scanning, Limit Access to Resource Over Network, Filter Network Traffic, Network Segmentation, Privileged Account Management, Application Isolation and Sandboxing
MITRE ATT&CK reference
Phishing
T1566
Initial Access
Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms.
Mitigations:
Network Intrusion Prevention, Restrict Web-Based Content, User Training, Antivirus/Antimalware, Software Configuration, Audit
MITRE ATT&CK reference
Command and Scripting Interpreter
T1059
Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.
Mitigations:
Restrict Web-Based Content, Limit Software Installation, Execution Prevention, Code Signing, Behavior Prevention on Endpoint, Privileged Account Management
MITRE ATT&CK reference
Software Deployment Tools
T1072
Execution
Lateral Movement
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager. Access to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems.
Mitigations:
Remote Data Storage, Limit Software Installation, User Training, Network Segmentation, Password Policies, User Account Management
MITRE ATT&CK reference
Scheduled Task/Job
T1053
Execution
Persistence
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system. Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.
Mitigations:
Operating System Configuration, User Account Management, Restrict File and Directory Permissions, Privileged Account Management, Audit
MITRE ATT&CK reference
Create Account
T1136
Persistence
Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Mitigations:
Operating System Configuration, Network Segmentation, Privileged Account Management, Multi-factor Authentication
MITRE ATT&CK reference
Boot or Logon Autostart Execution
T1547
Persistence
Privilege Escalation
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.
MITRE ATT&CK reference
MITRE ATT&CK techniques attributed to Nightspire across its recorded activity. They describe the group overall, not any single incident.
Tooling observed in Nightspire operations
- Everything.exe
- MEGA
- WinSCP
Software reported in use by Nightspire. Most are legitimate administration or transfer utilities; their presence in an environment is a signal to investigate, not proof of compromise.
Indicators of compromise
Showing a sample of 2 SHA256, 5 EMAIL on file. Hashes and network indicators published for Nightspire. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.
YARA detection rules
nightspire.yar
/*
nightspire ransomware
*/
rule nightspire_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.nightspire"
description = "Detects nightspire ransomware ransom note or artifact"
date = "2026-05-04"
severity = 7
score = 70
strings:
$name1 = "nightspire" ascii nocase
$name2 = "NIGHTSPIRE" ascii
$onion = "nightspire.onion" ascii nocase
condition:
any of them
}
Community-contributed rules for Nightspire, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.
