Overview
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
What public reporting says
- No government attribution has been published, and no arrests or indictments. Some infrastructure indicators point to an India-linked operator nexus with possible Chinese-speaking involvement; we treat that as a lead, not a finding. The group is likely a rebrand of the earlier Rbfs operation.
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America96
India13
Türkiye12
France12
Taiwan, Province of China11
Spain11
Hong Kong9
Italy9
Egypt9
Brazil8
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Fortinet | FortiOS & FortiProxy | CVE-2024-55591 | Network edge | esentire.com, forescout.com, s-rminform.com, checkpoint.com, ccb.belgium.be, checkpoint.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Compromised RDP credentials used for initial access.
- T1110 · Brute Force: Brute-forcing remote login credentials (RDP) and MFA fatigue attacks.
- T1190 · Exploit Public-Facing Application: Exploitation of CVE-2024-55591 — FortiOS/FortiProxy authentication bypass; unauthenticated attackers gain super-admin privileges via crafted POST requests to /api/v2/cmdb/.
- T1566 · Phishing: Malicious attachments and drive-by downloads.
Execution (TA0002)
- T1059 · Command and Scripting Interpreter: PowerShell scripts, batch files, PsExec, WMI; conhost.exe command execution window.
- T1072 · Software Deployment Tools: Abuse of legitimate tools (WinSCP, MEGACmd, 7-Zip, PsExec) across the attack chain.
Persistence (TA0003)
- T1053 · Scheduled Task/Job: Persistence via Windows Task Scheduler; service creation and modification.
- T1136 · Create Account: Administrative account creation post-exploitation on FortiGate devices.
- T1547 · Boot or Logon Autostart Execution: Reboot persistence mechanisms.
- T1547.001 · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: Persistence via HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce.
Privilege Escalation (TA0004)
- T1068 · Exploitation for Privilege Escalation: FortiOS super-admin access via CVE-2024-55591 exploitation.
Defense Evasion (TA0005)
- T1027 · Obfuscated Files or Information: Obfuscation techniques to evade analysis.
- T1036 · Masquerading: Renamed processes and use of legitimate tools (WinSCP, MEGACmd, 7-Zip, PsExec) blending into normal operations.
- T1070 · Indicator Removal: Removal of forensic indicators from compromised systems.
- T1218 · System Binary Proxy Execution: Execution via legitimate system binaries (LOLBins) to evade detection.
Credential Access (TA0006)
- T1003 · OS Credential Dumping: Credential dumping via Mimikatz.
- T1003.001 · OS Credential Dumping: LSASS Memory: LSASS memory extraction for credential harvesting.
- T1552 · Unsecured Credentials: Harvesting of stored credentials within the environment.
Discovery (TA0007)
- T1046 · Network Service Discovery: Network scanning to map internal infrastructure using Advanced IP Scanner.
- T1057 · Process Discovery: Process enumeration on compromised systems.
- T1082 · System Information Discovery: Collection of system details from compromised hosts.
- T1083 · File and Directory Discovery: File indexing and enumeration using Everything.exe.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: RDP-based lateral movement across compromised network.
- T1021.002 · Remote Services: SMB/Windows Admin Shares: Lateral movement via PsExec over SMB.
- T1047 · Windows Management Instrumentation: WMI-based execution and lateral movement.
Collection (TA0009)
- T1119 · Automated Collection: Automated sensitive data gathering from compromised systems.
- T1560 · Archive Collected Data: Compression of collected data using 7-Zip (7z2408-x64.exe) prior to exfiltration.
- T1560.001 · Archive Collected Data: Archive via Utility: 7-Zip archiving of stolen data prior to exfiltration.
Exfiltration (TA0010)
- T1041 · Exfiltration Over C2 Channel: Data exfiltration over C2 channel.
- T1048 · Exfiltration Over Alternative Protocol: Data exfiltration via WinSCP (v6.3.7) and Rclone over encrypted channels.
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: MEGACmd used to upload stolen data to MEGA cloud storage. Documented exfiltration of 1.5TB from a single healthcare victim.
Command and Control (TA0011)
- T1071 · Application Layer Protocol: Standard web protocols and Tor-based communication. Multi-channel comms: ProtonMail, OnionMail, Gmail, Telegram, qTox.
- T1573 · Encrypted Channel: Asymmetric encrypted non-C2 protocols used to evade IDS.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Hybrid AES-256 (file content) + RSA-2048 (key protection) encryption; appends .nspire extension; processes files in 1MB block chunks. Double extortion model — data theft + encryption.
Resource Development (TA0042)
- T1587 · Develop Capabilities: Custom Go-based ransomware development with modular architecture.
Tools
- Everything.exe
- MEGA
- WinSCP
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| NightSpire | DLS | a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd[.]onion | No |
| NightSpire | DLS | nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd[.]onion | No |
| Verify human - NightSpire | DLS | nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd[.]onion | Yes |
| RaaS Service Started | DLS | nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad[.]onion | Yes |
| Database | NightSpire | DLS | nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd[.]onion | No |
| Database | NightSpire | DLS | nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11