NightSpire Is the Busiest Ransomware Crew on Earth Right Now. We Built Their Profile This Morning — RDP, Chrome Remote Desktop, and a .nspire Extension.
- Patrick Duggan
- Jun 9
- 4 min read
This morning our adversary index pulled in a fresh profile for a ransomware crew called NightSpire, and by the time I sat down to look at the day's leak-site activity, NightSpire was sitting at the top of it — twenty-six victims claimed in a single daily digest, more than LockBit and DragonForce combined on the same day. That is not a fluke of one bad afternoon. NightSpire first surfaced in February 2025 as a closed, operator-driven crew, and across 2026 it has rolled past two hundred and fifty claimed victims spanning manufacturing, healthcare, finance, education, hospitality, IT services, and logistics, in more than thirty countries with the United States leading the list. The reason I am writing this the same day we profiled them is the whole point of the way we work: by the time a crew is the busiest name on the board, the question is not "who are they," it is "did you already have them mapped." We did, as of this morning, and here is what the map says.
NightSpire is financially motivated ransomware plus data-extortion, and the most important fact about them in mid-2026 is that they are in the middle of going commercial. They started as a tight operator crew running their own intrusions, and this year they announced an affiliate program — the classic ransomware-as-a-service transition, where the core team rents the payload and the infrastructure to outside affiliates and takes a cut. That transition is why the victim count is spiking now. A closed crew is rate-limited by how many networks its own operators can personally break into; an RaaS turns the volume dial over to dozens of affiliates at once, which is exactly the shape of twenty-six victims in a day. When you see a crew's numbers go vertical, look for the affiliate announcement that preceded it, because the volume is almost always a staffing change, not a capability change.
The tradecraft is unglamorous, and that is the part defenders should take seriously. Initial access is typically through exposed RDP — Remote Desktop Protocol sitting on the public internet, the oldest open door in the business — and once inside, they install Chrome Remote Desktop and AnyDesk to establish quieter, more durable remote access that blends in with legitimate IT tooling. The payload is written in Go, appends the .nspire extension to encrypted files, and uses a hybrid encryption scheme: partial encryption in roughly one-megabyte blocks on large or high-value files so the encryption runs fast, full encryption on small documents and images. Then it is double extortion the way everyone does it now — steal the data first, encrypt second, and run a dedicated Tor leak site to publish the names of anyone who does not pay. There is nothing exotic here. No zero-day, no novel loader, no nation-state craft. It is an exposed remote-access port and a pair of off-the-shelf remote-desktop tools, which is precisely why it works at scale across so many industries: the soft surface they exploit is everywhere.
That ordinariness is the defender's advantage, because every step in that chain is something you can close or detect without buying anything new. The exposed RDP is the front door, and it should not be on the public internet at all — put it behind a VPN with multifactor, or better, behind an identity-aware proxy, and the single most common NightSpire entry vector evaporates. The Chrome Remote Desktop and AnyDesk installs are the tell for the post-access stage: if your environment has a standard remote-support tool, then a second or third remote-desktop agent appearing on a server is an alarm, not noise, and it is one of the cleanest behavioral detections you can write. The partial-block encryption pattern and the sudden bloom of .nspire extensions are late signals — by then the data is already gone — so the value is entirely in catching the remote-access stage, which is loud if you are listening for unauthorized remote-desktop tooling and anomalous logons. We have said this about crew after crew this year, from the Tor-exit-relay operators we mapped to the Clop Oracle E-Business Suite wave: the money is in watching the access layer, not the encryption layer.
I am not going to tell you NightSpire is sophisticated, because they are not, and the security press calling every busy crew "advanced" is part of why defenders feel hopeless. NightSpire is the opposite of advanced — they are organized, they rented out their payload, and they are walking through doors that should have been locked. That is the honest read, and it is also the actionable one: the crew topping the global victim board this week gets in through exposed RDP and commodity remote-desktop tools, which means the defense is not exotic either. Close the remote-access surface, alarm on the second remote-desktop agent, and you have defeated the specific thing that made them the busiest name on the leak sites this morning. We had the profile before lunch; the harder part, as always, is that the doors were open long before we wrote it down.
The threat feed this post is built on
1.14M+ IOCs, STIX 2.1, precursor signals, supply-chain detection. Free API key in 30 seconds.
Comments