NightSpire Ransomware Decryption & Data Recovery

NightSpire was first observed in February 2025 and its dark-web leak site went live that March. It is one of the fastest-growing emerging double-extortion crews of the past two years. It began as a closed, self-run operation: intrusion, lateral movement, exfiltration and negotiation were all handled by core members, with no public affiliate programme. In April 2026 the group began openly recruiting affiliates on its leak site and announced a move to ransomware-as-a-service, which makes subsequent tradecraft more varied and harder to predict.

Barracuda's May 2026 profile assesses NightSpire as a rebrand of the short-lived Rbfs extortion operation from early 2025: the code differs, but personnel and infrastructure carry over, with publicly visible operator handles xdragon128 and cuteliyuan. Researchers also note weak operational security - browsable leak-site directories, a leaked server hostname, even consumer mail accounts used in negotiations. The profile is an aggressive crew with limited engineering maturity.

The scale is no longer small, though counts differ sharply between trackers. As of September 2026 ransomware.live records more than 320 named organisations across 53 countries; Barracuda's May 2026 profile gives 259. Manufacturing leads, followed by technology, professional services, healthcare and retail, and the most-affected countries are the United States, then India, Turkey, France and Taiwan. Halcyon reads the picture differently: it assesses that activity faded through the second quarter of 2026, describes the group as near-dormant by mid-year, and counts only 25 to 30 publicly named victims. This entry treats the group as still active because new leak-site listings continue to appear, but the sources genuinely conflict and no single figure should be taken as settled. Targets are mostly small and mid-sized organisations with broad external exposure and weak baselines - opportunistic selection, not vertical targeting.

For Chinese enterprises the relevant point is the entry path itself: known Fortinet edge-device vulnerabilities and weak RDP are exactly the exposures most common in manufacturing and cross-border branch networks. No public report confirms a campaign aimed at mainland China, but Asia-Pacific victim counts are substantial, and overseas subsidiaries sit squarely inside the target space.

Extension. The .nspire suffix is appended to the full original filename, so order.xlsx becomes order.xlsx.nspire. The base name is neither rewritten nor randomised.

Ransom note. A plain-text note is dropped in every directory containing encrypted files. Three filenames are publicly documented: readme.txt (the early, dominant form recorded by SonicWall and Proven Data), _nightspire_readme.txt (a December 2025 build per Huntress) and [nspire_msg].txt (a March 2026 build per Huntress; the square brackets come from a written description rather than a verified sample screenshot). The note carries a per-victim UUID and, in some builds, an access password for the Tor negotiation portal. The text stresses that data has already been copied out and sets a deadline as short as 48 hours.

An indicator that is easy to miss. The note explicitly claims that OneDrive files are encrypted too. NightSpire encrypts files in synced OneDrive folders without changing extensions or icons, so Explorer looks normal while the contents are already overwritten. Scoping an incident purely by counting .nspire files will therefore understate the damage badly.

Host artefacts. The encryptor is dropped by hand as an ordinary executable in a user-writable directory; the filename varies between operations and should not be treated as a fixed indicator. The same engagements show installs of Chrome Remote Desktop, AnyDesk, Everything (voidtools), 7-Zip and MEGAsync, and the incidents Huntress analysed also involved VMware Workstation and WPS Office. Because the encryptor is rebuilt per operation - Huntress compared December 2025 and March 2026 builds and found different hashes - hash-only detection is not sufficient.

NightSpire relies on no zero-days; everything reduces to exposure plus credentials:

• Edge-device vulnerabilities. Both 360 and Barracuda rank CVE-2024-55591, the FortiOS/FortiProxy authentication bypass, as the primary initial vector - successful exploitation yields super-admin access directly.
• RDP. Brute-forced or credential-stuffed RDP is the other frequent path; the March 2026 incident analysed by Huntress began with stolen RDP credentials.
• Phishing, MFA fatigue and RMM abuse. Used to get past accounts that do have multi-factor authentication.
• Persistence. Chrome Remote Desktop and AnyDesk are installed as resident channels, which are harder to block outright than a custom backdoor.
• Lateral movement and discovery. What recurs in first-hand incident analysis is file-search tooling such as Everything (voidtools), used to locate high-value data quickly. Credential-dumping and remote-execution utilities of the Mimikatz or PsExec type appear in aggregated write-ups but are not individually confirmed in the published case analyses - hunt for them as possible, not certain.
• Exfiltration. 7-Zip archives uploaded through MEGA/MEGAsync, WinSCP and similar channels, establishing the double-extortion leverage.

The pattern is unmistakably hands-on-keyboard: operators dwell, verify hosts one by one, then detonate the encryptor at a chosen moment. The upside for responders is that such operations usually leave a rich, reconstructable log trail.

Encryptor. A single Go executable, statically linked with its own runtime. Every first-hand incident analysis available - Huntress, SonicWall, Barracuda and others - documents Windows samples only. Halcyon's profile describes Linux and ESXi variants as in development and not yet deployed, and commercial recovery-site claims about a "NightSpire ESXi encryptor" lack credible technical corroboration. This entry therefore lists Windows alone; risk to virtualised estates should be read as theoretically possible but unproven, not as evidence that a mature ESXi encryptor exists.

Algorithms. Public analysis describes a conventional hybrid scheme - a symmetric cipher for file content with RSA wrapping the file keys - commonly summarised as AES-256 plus RSA-2048, with some analyses also noting RC4/XOR-style obfuscation in the samples. The descriptions are not fully consistent and no complete public reverse-engineering report corroborates them, so parameters should be measured on real samples. Whatever the specifics, without the operators' private key there is nothing to reverse.

Block-based encryption is the decisive trait. NightSpire uses a speed-first hybrid strategy: large files such as iso, vhdx, vmdk, zip, bak and mdf are only partially encrypted block by block, while everything else is encrypted in full. No authoritative public figure for the block stride exists, so it has to be measured per sample. That distinction still drives the recovery plan. Virtual disks, database files and backup archives often retain large untouched regions that structural repair can exploit; Office documents, drawings and source files are typically overwritten completely and depend entirely on copies or backups.

Shadow copies. Unlike most mainstream families, public incident analysis does not record NightSpire systematically deleting volume shadow copies or disabling Windows recovery - Huntress notes the operators leaned on installed third-party tools rather than the native commands other crews use for this. That is no assurance copies survive in any given case: operators may still clear them by hand, and snapshots can be aged out by writes. But checking VSS immediately is essential, because it is an unusually valuable recovery window for this family. Treat it as a working assumption to verify on site, not as a property of the family.

Double extortion. Data is stolen before encryption; refusal leads to public naming on the leak site and staged publication of the data. Both 360 and ransomware.live record the pressure model as very short deadlines - as little as two days - combined with reputational exposure through public listing.