Operator dossier

Spirals is a ransomware operator currently active on public leak sites. Darkfield has indexed 7 public victims claimed by this operator between September 18, 2026 and October 3, 2026. Spirals is a ransomware group first observed in September 2026 with an apparent financial motivation, though the limited scope of publicly documented activity makes definitive attribution of intent difficult at this time. Based on available data, the group has been linked to a single confirmed victim within the technology sector, and no reputable sources including CISA, FBI, Mandiant, or established threat intelligence vendors have published detailed findings regarding their country of origin, organizational structure, or potential affiliation with known ransomware ecosystems or RaaS platforms. Due to the nascent and limited nature of their observed activity, specific details regarding initial access vectors, tooling, encryption methodology, or extortion tactics have not been publicly documented by authoritative sources, and any characterization of their technical capabilities would be speculative at this stage. The group's sole confirmed campaign targeted a technology sector organization, though the identity of the victim, ransom demands, and operational outcomes have not been publicly disclosed by credible reporting bodies. As of the time of this profile, Spirals remains an emerging and largely uncharacterized threat actor with insufficient documented activity to assess current operational tempo, continuity, or potential rebranding, and analysts should treat this group as one requiring continued monitoring as additional intelligence becomes available.

Most-targeted sectors

Technology1 victims

Recent disclosures by Spirals

All 7 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Spirals →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Spirals

7 victims indexed · first seen 24 days ago · last activity 10 days ago

Victims indexed

#266 of 410 tracked operators

Active period

Sep 2026 → Oct 2026

—

Countries hit

At a glance

Status: active
First seen: 24 days ago
Last activity: 10 days ago
Onion sites: 1 known endpoint
Primary sector: Technology · 1 hits

About

Spirals is a ransomware group first observed in September 2026 with an apparent financial motivation, though the limited scope of publicly documented activity makes definitive attribution of intent difficult at this time. Based on available data, the group has been linked to a single confirmed victim within the technology sector, and no reputable sources including CISA, FBI, Mandiant, or established threat intelligence vendors have published detailed findings regarding their country of origin, organizational structure, or potential affiliation with known ransomware ecosystems or RaaS platforms. Due to the nascent and limited nature of their observed activity, specific details regarding initial access vectors, tooling, encryption methodology, or extortion tactics have not been publicly documented by authoritative sources, and any characterization of their technical capabilities would be speculative at this stage. The group's sole confirmed campaign targeted a technology sector organization, though the identity of the victim, ransom demands, and operational outcomes have not been publicly disclosed by credible reporting bodies. As of the time of this profile, Spirals remains an emerging and largely uncharacterized threat actor with insufficient documented activity to assess current operational tempo, continuity, or potential rebranding, and analysts should treat this group as one requiring continued monitoring as additional intelligence becomes available.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/spirals

Timeline

1 months

2026-09-01T00:00:00+00:002026-09-01T00:00:00+00:00

Top sectors

Technology

Technology dossier →

MITRE ATT&CK

1 techniques · 1 tactics

Tactics

Impact

Techniques

T1486Data Encrypted for Impact

Recent victims

Loading recent victims

Onion infrastructure

1 known

http://spiralstfe7rtbna7zlv6szdwmjvjszf2d64zkf6z5jykrwnw5jbgpyd.onion

Source

Updated 10 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Spirals posts a victim.

Add Spirals to your watchlist — Pro pings you within 5 minutes of any new Spirals leak-site post, Telegram callout, or affiliate-rebrand inference.