Threat Research

Emulating the Persuasive NightSpire Ransomware

AttackIQ

NightSpire is a financially motivated ransomware and data extortion group that emerged in early 2025, using double extortion via a dedicated leak site and has recently launched a RaaS program to expand operations. Its Go-based payload appends the .nspire extension, uses hybrid partial/full encryption, leverages living-off-the-land tools (PowerShell, WMI, PsExec) and credential dumping (Mimikatz), and AttackIQ released an emulation to validate defenses against these behaviors. #NightSpire #AttackIQ

Keypoints

  • NightSpire emerged in early 2025 as a closed operator-driven ransomware/data extortion group and has since announced a ransomware-as-a-service (RaaS) program to scale via affiliates.
  • The group targets small- and medium-sized organizations across sectors (manufacturing, technology, healthcare, financial services, government) in over 30 countries.
  • The ransomware payload is written in Go, appends the “.nspire” extension, uses a hybrid encryption approach (partial block encryption for large files and full encryption for smaller files), and drops victim-specific ransom notes with UUIDs.
  • Initial access vectors include phishing and exploitation of exposed services, notably observed abuse of CVE-2024-55591 in FortiOS appliances.
  • Post-compromise activity relies heavily on living-off-the-land techniques (PowerShell, WMI, PsExec) and credential dumping tools such as Mimikatz to move laterally and escalate access.
  • AttackIQ published an emulation of NightSpire behaviors (including discovery, profiling, and encryption stages) to help organizations validate detection and prevention controls and improve incident response readiness.

MITRE Techniques

  • [T1105 ] Download and Transfer of Files – NightSpire samples are downloaded and saved to disk for testing delivery prevention (“The Nightspire Ransomware Sample (SHA256: c5f526cc… ) is first downloaded and then saved to disk in two separate scenarios to test network and endpoint controls”).
  • [T1124 ] System Time Discovery – The malware checks system time via the GetSystemTimeAsFileTime API to obtain UTC time for profiling (“This scenario simulates checking system time using the GetSystemTimeAsFileTime Windows API, which returns the current UTC time.”).
  • [T1012 ] Query Registry – NightSpire retrieves MachineGUID from the registry using reg query to establish a unique victim identifier (“It targets the MachineGUID entry within the HKLMSOFTWAREMicrosoftCryptography registry key which contains a unique identifier of the system.”).
  • [T1082 ] System Information Discovery – The ransomware gathers system information via APIs such as GetSystemInfo, GetComputerNameExW, GetLogicalDrives, and FindFirstVolumeW to profile hosts and enumerate storage (“This scenario executes the GetSystemInfo Windows native API call to retrieve system information.”).
  • [T1033 ] Account Discovery (System Owner/User Discovery) – NightSpire retrieves the logged-in user and account name using GetUserNameW/GetUserNameExW to build host context (“This scenario executes the GetUserNameW Windows native API call to retrieve the account name associated with the local computer.”).
  • [T1016 ] System Network Configuration Discovery – The malware calls GetAdaptersInfo to enumerate network adapters and connectivity (“This scenario executes GetAdaptersInfo Windows native API call to retrieve adapter information from the local computer.”).
  • [T1057 ] Process Discovery – NightSpire enumerates running processes using CreateToolhelp32Snapshot and iterates with Process32FirstW/Process32NextW (“This scenario executes the CreateToolhelp32SnapshotWindows native API call to receive a list of running processes and iterates through each process object with Process32FirstW and Process32NextW.”).
  • [T1007 ] Service Discovery – The ransomware queries service status using QueryServiceStatusEx and EnumDependentServices to identify active services (“This scenario executes the QueryServiceStatusEx and EnumDependentServices Windows API calls to retrieve information corresponding to a given service.”).
  • [T1120 ] Drive Type Discovery – NightSpire uses GetDriveTypeW to determine information about physical disks and storage targets (“This scenario retrieves information about the system’s physical disks using the GetDriveTypeW Windows API call.”).
  • [T1083 ] File and Directory Discovery – The malware enumerates the file system with FindFirstFileW and FindNextFileW to identify files for encryption (“This scenario executes the FindFirstFileW and FindNextFileW Windows native API calls to enumerate the file system.”).
  • [T1486 ] Data Encrypted for Impact – NightSpire performs file encryption (AES-256 CBC and RSA-2048) and appends the .nspire extension, using partial block encryption for large files and full encryption for smaller files (“This scenario performs the file encryption routines used by common ransomware families. Files matching an extension list are identified and encrypted in place using similar encryption algorithms as used by NightSpire ransomware.”).
  • [T1003 ] Credential Dumping – AttackIQ recommends emulating obfuscated Mimikatz to replicate NightSpire-style credential dumping (“This scenario utilizes an obfuscated version of Mimikatz to dump passwords and hashes for Windows accounts.”).
  • [T1021.002 ] Lateral Movement: Remote Services (PAExec) – Emulation includes lateral movement using PAExec (PSExec-like) to move across hosts (“This scenario simulates lateral movement within a network using PAExec, an open-source version of PSExec.”).
  • [T1047 ] Lateral Movement via WMI – NightSpire emulation covers lateral movement using WMI to execute commands on remote assets (“This scenario attempts to move laterally to any available asset inside the network through the use of WMI.”).

Indicators of Compromise

  • [File Hash ] Emulation/sample binaries and identified payloads – SHA-256: c5f526cc62688cf34c49d098dab81e24e4294f832ada57433ef505d5ac6da8f3, 8f58870a3e5df1d904940c7ef2ad160b90ba739c7e5e21e4c908945e0a6f3f60
  • [File Extension ] Encrypted files appended by NightSpire – .nspire
  • [Vulnerability/CVE ] Exploited exposed services for initial access – CVE-2024-55591 (FortiOS firewall appliances)
  • [Registry Artifact ] System-specific identifier used to generate victim IDs – HKLMSOFTWAREMicrosoftCryptographyMachineGUID (MachineGUID)

Read more: https://www.attackiq.com/2026/04/14/nightspire-ransomware/