— NightSpire¶
Threat-actor battle card · maintained from public sources · last updated 2026-10-07
Overview¶
NightSpire is a financially motivated ransomware operation active since early 2025. It originally ran in-house, with no affiliate network, but announced a pivot to a ransomware-as-a-service (RaaS) model around April 2026, inviting affiliates — a correction to this card's prior "purely in-house" framing (AttackIQ, Barracuda, Halcyon all name the RaaS announcement; whether affiliates have materialized in practice is unclear, and the steady-but-unspectacular post-pivot pace argues against a large affiliate base so far). It has claimed 300+ victims across 28+ industries as of early October 2026; third-party trackers disagree sharply on the exact cumulative count (snapshots since September range from ~193 to ~326 depending on methodology), so this card uses directional language rather than a single precise figure pending a direct pull from a live DLS tracker. Pace has settled at roughly 8-9 new victims per 30 days since August — down from the Q1 2026 peak (74 in Q1 alone) but not the near-dormant trickle this card previously described; L3M is estimated at ~25. Manufacturing remains the single largest targeted sector (18%), followed by Business Services and Healthcare. The US accounts for the majority of victims (71+), with France (11), Spain (10), India (10), and Turkey (9) the next highest.
Tradecraft¶
- Double-extortion: exfiltrate then encrypt; threatens publication and third-party data sale when deadlines expire.
- Aggressive ransom deadlines, sometimes as short as two days.
- Pivoted from a closed, in-house model to an announced RaaS/affiliate program around April 2026 (AttackIQ, Barracuda, Halcyon) — affiliate network, if it has materialized, has not yet produced a Q1-style volume spike.
- Targets predominantly SMEs with limited cybersecurity infrastructure; ransom demands typically $150K–$2M.
- Primary confirmed initial-access vector: CVE-2024-55591 (Fortinet FortiOS/FortiProxy authentication bypass, CVSS 9.6), exploited in-the-wild by NightSpire from Q4 2024 into Q1 2026 — Bitsight. RDP brute-forcing against cloud-hosted hosts is emerging as a parallel initial-access vector as FortiOS patching reduces that vector's yield.
- Per-operation encryptor builds with varying hashes and ransom-note filenames across intrusions (not a single static binary), complicating static-IOC defense — Huntress.
- Encryptor also corrupts OneDrive-synced files in place without changing filenames or icons, so synced files appear normal but are unopenable — SonicWall Capture Labs.
Notable recent victims¶
- Winona County, Minnesota (US, government) — attack detected April 7, 2026; second ransomware attack on county this year; MN National Guard assisted; NightSpire leaked data DLS June 14, 2026; county confirmed data release same day — GovTech
- Krum Public Library, Texas (US, government/education) — attack May 14, 2026; 50 GB: financial docs, HR data, supervisor info; city confirmed June 3, 2026; no SSNs/financial info compromised — Dysruption Hub
- Artistic Smiles (US, consumer services) — DLS, June 2026
- Dean Cosmetic Dentistry (US, healthcare) — DLS, June 2026 (attack est. May 2025)
Assessment¶
A mid-tier operator with 300+ victims across 28+ industries as of early October 2026, rank 8 on the Tier-1 leaderboard. Its April 2026 pivot from a closed, in-house structure to an announced RaaS/affiliate model is the most consequential tradecraft update since this card was first written — it removes the "no affiliate network to disrupt" assumption, though volume has stayed at a steady ~8-9 victims/30 days rather than spiking, suggesting affiliate recruitment (if real) hasn't yet scaled. Primary access via CVE-2024-55591 (FortiOS auth bypass) remains well-understood and increasingly patched; RDP brute-forcing against cloud-hosted hosts and a OneDrive-aware encryption capability are the notable new tradecraft data points. No law-enforcement action and no CISA/FBI/NCSC advisory naming the group has surfaced. Several post-mid-August DLS claims (DiamondLease, Great Bay Bio, Perimetral Oriental de Bogotá, 360 Consulenza, AKOL LAW) remain unconfirmed by any named victim statement and are not listed below pending corroboration. A secondary-source theory that NightSpire is a rebrand of the earlier Rbfs operation could not be traced to a primary source this review and is not adopted.
Sources¶
- Barracuda Networks — NightSpire: Wannabe warlords in ransomware's shadow realm
- AttackIQ — Emulating the Persuasive NightSpire Ransomware
- HivePro — NightSpire Ransomware Expands Reach with Aggressive Extortion Deadlines
- Picus Security — NightSpire Ransomware Attack Chain, Tools and Tactics
- Huntress — NightSpire Ransomware: In-Depth Analysis
- SOS Ransomware — NightSpire ransomware group
- ProvenData — NightSpire Ransomware: Technical Deep-Dive
- DeXpose — NightSpire ransomware victims
- Halcyon — Emerging Threat Actor: NightSpire Ransomware
- SonicWall Capture Labs — NightSpire OneDrive-aware encryption
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
September 2026
July 2026
June 2026
May 2026