NightSpire ransomware abuses RDP and remote admin tools to stay hidden before encryption

NightSpire ransomware operators are using Remote Desktop Protocol access and trusted remote administration tools to maintain stealthy persistence before stealing data and encrypting files. The activity shows how ransomware crews can blend into normal IT activity by relying on software that many organizations already allow.

Picus Security says NightSpire is a double-extortion ransomware family first identified in early 2025. The group steals files before encryption, then threatens to publish the data on a Tor-based leak site if victims refuse to pay.

A separate Huntress investigation into a March 2026 incident found attackers using RDP, Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, and MEGASync across the intrusion chain. The attack relied less on custom malware during the early stages and more on legitimate tools that can avoid quick suspicion.

Why NightSpire is getting attention

NightSpire has moved quickly across multiple countries and sectors. Picus reported at least 64 victim organizations across 33 countries between March and June 2025, with activity affecting healthcare, education, government, finance, manufacturing, hospitality, IT services, and logistics.

The ransomware encryptor is written in Go and appends the .nspire extension to encrypted files. It also drops ransom notes in affected folders. In some cases, ransom notes claimed that OneDrive files were encrypted without changing their extensions, which can make impact assessment harder for victims.

The danger comes from the full chain. Attackers first gain access, install remote administration tools, find sensitive data, compress it, upload it to cloud storage, and then run the encryptor. By the time encryption starts, data theft may already have occurred.

Category	NightSpire detail
Ransomware model	Double extortion through data theft and file encryption
Initial access	Observed RDP access in investigated incidents
Persistence	Chrome Remote Desktop and AnyDesk
Discovery	Everything file search utility
Staging	7-Zip archives
Exfiltration	MEGASync uploads to MEGA cloud storage
Encrypted extension	.nspire

RDP remains the entry point

In the March 2026 incident reviewed by Huntress, the attacker accessed an endpoint through RDP several days before the ransomware activity was detected. That gave the intruder interactive access before later tools were deployed.

MITRE ATT&CK describes Remote Desktop Protocol abuse as a technique where adversaries use valid accounts to log into a remote system and act as that user. This fits the risk defenders face when RDP is exposed, weakly protected, or tied to compromised credentials.

RDP is not malicious by itself. It is a standard administration feature. The problem starts when attackers obtain working credentials or find remote access paths that lack strict controls.

• Limit RDP exposure to trusted networks and VPN paths.
• Require multi-factor authentication for remote access.
• Disable unused RDP access across endpoints and servers.
• Monitor logins from unusual IP addresses or countries.
• Alert on RDP sessions outside normal working hours.
• Review failed and successful login patterns together.

Remote admin tools help attackers blend in

After gaining access, the attackers installed legitimate remote access tools instead of relying only on custom malware. Chrome Remote Desktop appeared on at least two compromised machines, while AnyDesk appeared on another endpoint.

This approach aligns with MITRE ATT&CK guidance on remote access software abuse. Attackers often use trusted tools to establish command-and-control access because these products may already appear normal in enterprise environments.

The tactic creates a detection problem. Security teams may allow AnyDesk, Chrome Remote Desktop, or similar tools for IT support, which means a new installation may not generate the same urgency as an unknown executable.

Tool	Observed role	Defensive concern
Chrome Remote Desktop	Persistent remote access service	Can look like normal support tooling
AnyDesk	Remote access with service and startup persistence	Can survive reboot and provide hands-on access
Everything	Fast file discovery	Helps attackers locate sensitive folders quickly
7-Zip	Data compression and staging	Reduces file volume before exfiltration
MEGASync	Cloud upload tool	Can move stolen data out through a common service

Discovery and exfiltration come before encryption

NightSpire’s impact begins before files are locked. Attackers use Everything to search for valuable data, then stage selected folders into compressed archives with 7-Zip. Those archives can then be uploaded through MEGASync.

The Huntress investigation found that attackers had to bring several tools into the environment rather than relying only on native tools. That gives defenders a chance to detect unusual downloads, installations, and process chains before encryption begins.

This stage is critical. If defenders spot Everything, 7-Zip, and MEGASync suddenly appearing on endpoints that do not normally use them, they may interrupt the attack before the ransomware runs.

NightSpire encryption behavior

Once launched, the Go-based encryptor enumerates accessible drives and paths, encrypts files, appends the .nspire extension, and drops ransom notes in folders containing encrypted content. Ransom note names observed in incidents include _nightspire_readme.txt and [nspire_msg].txt.

Picus Security also notes that NightSpire’s OneDrive behavior deserves attention because the ransomware note claimed cloud-stored OneDrive files were locked without extension changes. That can complicate recovery checks if teams look only for .nspire filenames.

Victims should avoid assuming that only files with changed extensions were affected. Cloud-synced folders, mapped drives, and shared locations need separate validation.

Indicator	Description
.nspire	Extension appended to many encrypted files
_nightspire_readme.txt	Ransom note observed in a December 2025 incident
[nspire_msg].txt	Ransom note observed in a March 2026 incident
Chrome Remote Desktop Service	Persistent service used for remote access
AnyDesk Service	Remote access service used for persistence
MEGASync	Cloud sync tool used during exfiltration activity

What defenders should monitor

Security teams should focus on behavior instead of only static ransomware hashes. NightSpire-linked activity includes remote access, tool staging, file discovery, archive creation, cloud upload, and encryption. Each stage creates an opportunity to detect and stop the attack.

MITRE ATT&CK notes that remote access tools can create interactive command-and-control channels. Organizations should maintain an approved list of remote support tools and alert when new or unauthorized tools appear.

Teams should also watch for unusual combinations. RDP access followed by Chrome Remote Desktop installation, Everything searches, 7-Zip archive creation, and MEGASync uploads should trigger an incident response review.

• New Chrome Remote Desktop or AnyDesk installations.
• Remote access tools running from unusual accounts.
• Everything launched on servers or finance file shares.
• 7-Zip creating large password-protected archives.
• MEGASync uploading from endpoints that never used it before.
• Unexpected conhost.exe activity around ransomware execution.
• Rapid creation of .nspire files across multiple directories.

How organizations can reduce NightSpire risk

Organizations should start by reducing direct RDP exposure. Remote access should sit behind VPN, identity controls, device compliance checks, and multi-factor authentication. Admins should also disable RDP where the business does not need it.

The StopRansomware Guide recommends restricting RDP and other remote services, using phishing-resistant MFA, applying least privilege, and keeping offline or immutable backups. Those controls directly weaken the NightSpire intrusion chain.

Application control also matters. If Chrome Remote Desktop, AnyDesk, Everything, 7-Zip, or MEGASync are not approved business tools, block or alert on installation and execution.

Control	Recommended action
RDP hardening	Restrict exposure, require MFA, and monitor all interactive sessions
Remote tool governance	Allow only approved remote support tools and block unauthorized installs
Cloud upload monitoring	Alert on unusual MEGASync activity and large archive uploads
Data staging detection	Watch for Everything searches followed by 7-Zip archive creation
Backup resilience	Maintain offline or immutable backups and test recovery
Incident playbooks	Define when to isolate endpoints, disable accounts, and block tools

Incident response steps

If NightSpire activity is suspected, defenders should treat it as a data theft and encryption incident. The response should not focus only on recovering files. Teams need to determine what data may have left the network before encryption began.

The StopRansomware Guide recommends isolating affected systems, securing backups, preserving evidence, and reporting ransomware activity to relevant authorities. Organizations should also rotate credentials that may have been exposed through RDP or remote admin tools.

Because NightSpire uses legitimate tools, teams should review installed software timelines. A new AnyDesk or Chrome Remote Desktop service can help identify when the attacker gained persistence.

1. Isolate affected endpoints from the network.
2. Disable compromised accounts and reset exposed credentials.
3. Review RDP logs, VPN logs, and remote access tool activity.
4. Check for Everything, 7-Zip, MEGASync, AnyDesk, and Chrome Remote Desktop.
5. Identify large archives created before encryption.
6. Review cloud upload logs and outbound traffic records.
7. Restore from clean backups only after containment is complete.

Why RDP monitoring needs context

RDP alerts should not stop at successful login events. Analysts need to connect RDP access with what happens next: service creation, software installation, file discovery, archive staging, and cloud uploads.

MITRE ATT&CK notes that attackers using RDP may act as the logged-on user. That means valid credentials can make malicious activity look legitimate unless monitoring connects identity, endpoint, and process behavior.

For ransomware defense, the key question is not only whether RDP was used. It is whether RDP was followed by behavior that does not match normal administration.

Bottom line

NightSpire shows how ransomware operators can move quietly by abusing normal administration channels. RDP provides the entry point, remote access tools provide persistence, file utilities support discovery and staging, and cloud sync tools help move stolen data before encryption.

Defenders should not wait for .nspire files to appear. The earlier warning signs are RDP access, unexpected remote admin tools, Everything searches, large 7-Zip archives, and unusual MEGASync uploads.

Organizations that control remote access, enforce approved software policies, monitor cloud uploads, and test recovery plans have a stronger chance of stopping the attack before encryption becomes the final visible symptom.

FAQ