NightSpire
An opportunistic double extortion group active since early 2025, with deadlines as short as 48 hours. It has exploited a Fortinet flaw and signalled a move to ransomware as a service in 2026.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
NightSpire gives victims little time. Barracuda says deadlines are often as short as 48 hours from the first ransom note, and that the group may contact employees, leak excerpts or pass data to other criminals.1
AttackIQ says victims are mainly small and medium-sized organisations with less mature controls, in more than 30 countries.2 Hive Pro lists the UK among countries with victims, without detail.4 Bitdefender notes NightSpire is among groups that have added malware with wiping modules.5
Origin is not settled. There is no government attribution. Barracuda suggests an India-linked operator nexus with possible Chinese-speaking involvement, but this rests on thin markers, one of which it thinks is probably a compromised host. It also links the group to a short-lived operation called Rbfs through shared operators and overlapping victims.1
A two-day deadline leaves little room to work out your position during an incident. We would agree legal, communications and ransom decision-making in advance.
How It Attacks
Based on Barracuda's and AttackIQ's reporting.1,2 Barracuda and AttackIQ both report a move to affiliates, and AttackIQ notes they may use different tools.
- 1
Get In
Exploits CVE-2024-55591 on Fortinet devices, or uses RDP brute force, credential stuffing, phishing, MFA fatigue or remote tools.
- 2
Blend In
Uses built-in tools such as PowerShell and WMI, and maps the network.
- 3
Harvest Credentials
Takes credentials from LSASS, including with Mimikatz.
- 4
Keep Access
Installs persistent remote access such as AnyDesk.
- 5
Collect and Steal
Stages and archives data, then sends it out with tools such as Rclone, WinSCP and MEGAcmd.
- 6
Encrypt and Extort
Runs a Go payload and threatens publication, often within 48 hours.
Key Techniques
Selected from AttackIQ's mapping and Barracuda's account.2,1 ATT&CK v20 has no entry for this group.
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits CVE-2024-55591. |
| T1110 | Brute Force | Credential Access | RDP brute force and credential stuffing. |
| T1621 | Multi-Factor Authentication Request Generation | Credential Access | MFA fatigue. |
| T1003.001 | LSASS Memory | Credential Access | Harvests credentials from LSASS. |
| T1047 | Windows Management Instrumentation | Execution | Used for execution and movement. |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | PsExec-style movement. |
| T1219.002 | Remote Desktop Software | Command and Control | Abuses AnyDesk for access. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Uses MEGAcmd and Rclone. |
| T1486 | Data Encrypted for Impact | Impact | AES-256 file encryption with RSA-2048 protected keys. |
Tools Observed
Discovery and Credentials
Remote Access and Movement
Collection and Exfiltration
From Barracuda, AttackIQ and Hive Pro.1,2,4 Many are legitimate products, so check whether they are approved and expected.
Vulnerabilities
Barracuda, AttackIQ and Hive Pro tie this flaw to the group.1,2,4
Patching this flaw will not address the group's other routes, such as stolen credentials.
Warning Signs
Drawn from Barracuda's account.1 None of these proves an attack alone.
- Access attempts against LSASS
- Unapproved AnyDesk or other remote tools
- Rclone, WinSCP or MEGAcmd on servers
- Repeated MFA prompts or RDP login failures
- Large archives appearing on servers before outbound transfers
Defences That Matter
Fix the Way In
- Patch Fortinet devices and check for signs of earlier compromise.
- Remove RDP from the internet.
Harden Identity
- Use phishing-resistant MFA to counter fatigue attacks.
- Protect LSASS and limit admin credentials on workstations.
Detect Data Leaving
- Alert on archive creation and transfers to cloud storage.
- Control remote tools with an approved list.
Prepare for 48 Hours
- Rehearse decisions under a two-day extortion deadline.
- Agree legal, communications and regulator contacts now.
Could You Decide in 48 Hours?
We can help you close the entry points and rehearse decisions under a short extortion deadline.
Sources
- Barracuda: NightSpire: Wannabe warlords in ransomware's shadow realm, 1 May 2026, updated 3 September 2026
- AttackIQ: NightSpire Ransomware, 14 April 2026
- AhnLab ASEC: May 2026 Threat Trend Report on Ransomware, 19 June 2026
- Hive Pro: NightSpire Ransomware Expands Reach with Aggressive Extortion Deadlines, undated, PDF path suggests September 2025
- Bitdefender: Threat Debrief, March 2026, 11 March 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.