Threat Intelligence Report April 8 - April 14 2025

NightSpire Ransomware Group

NightSpire is an emerging ransomware operation that surfaced in early 2025. While it shares characteristics with established Ransomware-as-a-Service (RaaS) models, NightSpire exhibits signs of inexperience, such as operational security lapses and the use of mainstream communication channels. Despite this, the group has rapidly expanded its victimology, targeting small to medium-sized enterprises across various sectors.

Attack Chain Analysis

• Exploits vulnerabilities in external-facing services, notably the FortiOS zero-day CVE-2024-55591, allowing unauthorised super-admin access to FortiGate firewalls. ​

• Utilises native Windows utilities such as PsExec, WMI, and RDP to traverse networks.​

• Deploys payloads using PowerShell scripts and obfuscated binaries.​

• Employs "living off the land" techniques, using legitimate system tools to avoid detection.​

• Implements a double extortion model: exfiltrates data using tools like MEGAcmd and WinSCP, then encrypts files, threatening to leak data if ransoms aren't paid. ​

IP Addresses

14.139.185.60: Associated with WinSCP remote server used by NightSpire. 

Hostnames

XDRAGON-SERVER1: Hostname observed in NightSpire attacks, linked to the operator alias 'xdragon128'. ​

File Artifacts

7z2408-x64.exe, 7zG.exe, 7z.exe: 7-Zip executables used to compress data prior to exfiltration.

Communication Channels

Gmail Addresses: Utilised for victim communication, indicating a lack of operational security

Tor-Based Leak Site: Hosts stolen data to pressure victims into paying ransoms.

Onion URLs

nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion

nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion

Nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion

Ransomware Victims Worldwide

A recent ransomware threat landscape analysis reveals that the United States remains the most significantly impacted nation, accounting for a substantial 52.2% of global incidents. This highlights the persistent targeting of US-based organisations by increasingly sophisticated ransomware operations.

Canada emerges as the second-most affected country, reporting 5.85% of global incidents, followed by India at 3.9%, and Germany, Italy, and Australia, each contributing 2.93%. These figures signal an intensifying focus on key global economies across North America, Europe, and Asia-Pacific.

Several other countries have experienced moderate levels of ransomware activity, including Japan and Singapore (2.44% each), as well as the United Kingdom, France, and Taiwan (1.95% each), reflecting a broader geographic distribution of ransomware attacks across the globe.

Nations reporting 1.46% of incidents each include Mexico, Brazil, China, and Spain — suggesting that even well-defended or geographically distant nations are not immune to these threats. Similarly, countries like Egypt, Saudi Arabia, Malaysia, and Poland each reported 0.98% of cases.

A number of countries recorded lower yet notable percentages of ransomware activity, each contributing 0.49% of global incidents. These include The Netherlands, Austria, China, Israel, Colombia, Indonesia, Argentina, Japan, Ireland, Switzerland, Sweden, Egypt, Iran, Ukraine, New Zealand, Greece, Turkey, Thailand, South Korea, South Africa, Peru, Portugal, Romania, Luxembourg, Czech Republic, Malta, Jordan, Hungary, and Cyprus.

This global distribution of ransomware incidents underscores the widening scope and international scale of cybercriminal operations. The findings highlight the urgent need for coordinated cybersecurity efforts, including cross-border intelligence sharing, robust threat detection capabilities, and resilient incident response plans to mitigate the escalating risk posed by ransomware threats.