Spirals

☆ pin

Reports

First seen

Jul 16, 2026

Last seen

Oct 3, 2026

Motivation

Financial

Targeting

Sectors

Transport & Logistics ×2 Technology ×1 Professional Services ×1 Financial Services ×1

Victim regions

×1

×2

United States×2

Oman×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1562.001 Disable or Modify Tools ×1T1486 Data Encrypted for Impact ×1T1021.002 Remote Services: SMB/Windows Admin Shares ×1T1003 OS Credential Dumping ×1T1047 Windows Management Instrumentation ×1T1190 Exploit Public-Facing Application ×1T1505.003 Web Shell ×1T1490 Inhibit System Recovery ×1T1219 Remote Access Software ×1

Indicators

domain ×9hash_sha1 ×2email ×1filename ×1hash_md5 ×1

Indicator values are available on Pro and via the API.

Recent reports

High

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Spirals publishes Seven Seas Group as ransomware victim

Spirals ransomware gang claims Armada Credit Bureau victim

Spirals ransomware gang claims Asyad Group, Oman's major logistics provider

Spirals ransomware gang publishes PITTSRAD as new victim

Spirals ransomware gang claims ANYTHINGIT victim

Spirals Ransomware Completes Corporate Intrusion in Under 24 Hours