nightspire Ransomware Group

Key insights

• •Utilizes a double extortion model by encrypting stolen data and threatening public release.
• •Gains initial access using exploits like CVE-2024-55591, RDP brute-forcing, and phishing.
• •Features a custom ransomware payload written in Go that appends the '.nspire' extension to encrypted files.
• •Employs living-off-the-land techniques, leveraging legitimate tools for data exfiltration.
• •Targets a wide range of industries with ransom demands ranging from $150,000 to $2 million.
• •Rapidly advanced from operational immaturity to a robust operation with Ransomware-as-a-Service offerings.