nightspire Ransomware
Tracked since Mar 12, 2025
1
victims recorded
1
in the last 30 days
1
CVEs
1d
Last activity
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
- CVE-2024-55591 Critical · 9.8 KEV Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1110 Brute ForceT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1059 Command and Scripting InterpreterT1072 Software Deployment Tools Persistence
T1053 Scheduled Task/JobT1136 Create AccountT1547 Boot or Logon Autostart ExecutionT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1027 Obfuscated Files or InformationT1036 MasqueradingT1070 Indicator RemovalT1218 System Binary Proxy Execution Credential Access
T1003 OS Credential DumpingT1003.001 OS Credential Dumping: LSASS MemoryT1552 Unsecured Credentials Discovery
T1046 Network Service DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1047 Windows Management Instrumentation Collection
T1119 Automated CollectionT1560 Archive Collected DataT1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1041 Exfiltration Over C2 ChannelT1048 Exfiltration Over Alternative ProtocolT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071 Application Layer ProtocolT1573 Encrypted Channel Impact
T1486 Data Encrypted for Impact Resource Development
T1587 Develop Capabilities Observed tools
Discovery Enum
Everything.exe
Exfiltration
MEGA · WinSCP
Most affected countries (30 days)
Most affected sectors (30 days)
- Technology1
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live