Ransomware.live: Nightspire

| Active | RaaS

NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.

Victims

362

First Victim

2025-02-17

(est. attack date)

Discovery Date

2025-03-12

Last Seen

2026-10-18

Inactive Since

days

Avg Delay

14.6

days

Infostealer

27.4%

victims with domain

Countries

hit

Uptime

63.7% avg (30d)

Data Exfiltrated

3.6 TB

reported across 29/362 victims

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months (based on attack estimated date if available)

+25% vs last month

Known Locations (6)

Title	Available	Last Visit	Server Info	FQDN
NightSpire	No	2026-08-22T08:08:05		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
NightSpire	Yes	2026-10-27T11:45:09	nginx	`a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion`
Database \| NightSpire	No	2026-08-22T08:08:23		`nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion`
Database \| NightSpire	No	2026-08-22T08:11:12		`nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion`
Verify human - NightSpire	Yes	2026-10-27T11:45:50	nginx	`nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion`
502 Bad Gateway	Yes	2026-10-27T11:47:12	nginx	`nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion`

Target

Heatmap

Ransom Notes (4)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Everything.exe placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	MEGA WinSCP

TTPs Matrix (13)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact	Resource Development
Valid Accounts	Command and Scripting Interpreter	Scheduled Task/Job	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping	Network Service Discovery	Remote Services: Remote Desktop Protocol	Automated Collection	Exfiltration Over C2 Channel	Application Layer Protocol	Data Encrypted for Impact	Develop Capabilities
Brute Force	Software Deployment Tools	Create Account		Masquerading	OS Credential Dumping: LSASS Memory	Process Discovery	Remote Services: SMB/Windows Admin Shares	Archive Collected Data	Exfiltration Over Alternative Protocol	Encrypted Channel
Exploit Public-Facing Application		Boot or Logon Autostart Execution		Indicator Removal	Unsecured Credentials	System Information Discovery	Windows Management Instrumentation	Archive Collected Data: Archive via Utility	Exfiltration Over Web Service: Exfiltration to Cloud Storage
Phishing		Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder		System Binary Proxy Execution		File and Directory Discovery

KQL Query (1)

Negotiation Chats (11)

YARA Rules (1)

Indicators of Compromise (IoCs) (23)

Email 5 Hash MD5 8 Hash SHA256 2 IP Address 2 Session 1 Telegram 2 Tox 3

Type	IOC
`Email`	`night.spire.team@gmail.com`
`Email`	`night.spire.team@onionmail.org`
`Email`	`night.spire.team@proton.me`
`Email`	`nightspire.team2026@onionmail.org`
`Email`	`nightspireteam.receiver@onionmail.org`
`Hash MD5`	`2bf543faf679a374af5fc4848eea5a98`
`Hash MD5`	`2e07a4de9e6ba84728fbdf27384ea0b9`
`Hash MD5`	`82afcebc49f49b758de83b3275c91137`
`Hash MD5`	`94dd3315fca4c31ef61b7865c3b8983f`
`Hash MD5`	`cc1da5f900c8d38f4d56006549e6734c`
`Hash MD5`	`d0a8b47c099440abaec8abfd7c12ac93`
`Hash MD5`	`e2d7d65a347b3638f81939192294eb13`
`Hash MD5`	`f11b894e9ef15124c6825fb479c8297b`
`Hash SHA256`	`35cefe4bc4a98ad73dda4444c700aac9`
`Hash SHA256`	`f749efde8f9de6a643a57a5b605bd4e7`
`IP Address`	`14.139.185.60`
`IP Address`	`144.172.106.251`
`Session`	`057d49830799b1fb3f73d7c6111f67a82322efedd8a04ff08011a38ade05459a02`
`Telegram`	`@nightspireteam2025`
`Telegram`	`night_spire_team`
`Tox`	`038F61A270B8094E713E4815C4FA5086E4AD3A021575C6F90EE65A0C123D3E3BF6926C3B59EA`
`Tox`	`3B61CFD6E12D789A439816E1DE08CFDA58D76EB0B26585AA34CDA617C41D5943CDD15DB0B7E6`
`Tox`	`8D663FD10BF662930F4C076CBF95FACFCC4ABD8F1A5E328DE75D0B0237A74E1AE1E0C5C37E7F`

Victims (362)

U**IN* Group