SUBJECT PROFILE
A rapidly maturing ransomware group first observed in February 2025 and strongly assessed as a rebrand of the defunct Rbfs operation, based on overlapping victims, shared infrastructure, and synchronized activity cessation. NightSpire reached 259 claimed victims across 30+ countries by May 2026, posting 74 victims in Q1 2026 alone to rank among the top active groups. In April 2026, the group publicly announced a shift toward a RaaS affiliate model, marking a structural evolution from its closed in-house operation.
Financial extortion via double-extortion ransomware
OPERATIONAL HISTORY
Exploitation of exposed perimeter assets (VPNs, RDP), credential stuffing, double extortion (encryption + data theft), Go-based ransomware payload (.nspire extension), VSS deletion, WinSCP exfiltration, MEGASync data staging, 7Zip/Everything for data collection, AnyDesk/Chrome Remote Desktop for persistence, Mimikatz credential dumping, PAExec lateral movement, ransom deadline pressure tactics
KNOWN INFRASTRUCTURE
Tor-based data leak site; Go (Golang) ransomware payload; WinSCP server (IP: 14.139.185[.]60 identified by S-RM); MEGASync for exfiltration; RaaS recruitment pages emerging on Tor onion domains (Feb–Mar 2026)