EN
DENightspire Ransomware: What You Need to Know & How to Recover Fast
NightSpire has claimed hundreds of victims on its Tor leak site since March 2025 — mostly small and mid-sized businesses worldwide, with Proven Data’s tracking recording 316 claimed victims across 53 countries in August 2026, exploiting exposed FortiGate appliances and RDP access to steal data before encryption. See how its .nspire payload has not been observed deleting shadow copies while quietly locking OneDrive files, and — if your systems are affected — how BeforeCrypt helps contain the damage and get you back to business.
What is Nightspire Ransomware?
NightSpire is a double-extortion group that emerged in February 2025, with leak-site tracking showing claimed victims in the hundreds across dozens of countries, concentrated among manufacturing, technology and professional-services firms with fewer than 1,000 employees. Its Go-based encryptor appends .nspire, block-encrypts large files for speed, and also locks data stored in Microsoft OneDrive without renaming it. BeforeCrypt checks for available decryption tools, including free ones, as part of every assessment. The payload has not been observed deleting Volume Shadow Copies. BeforeCrypt can help contain the attack, assess which recovery options are realistic, and restore operations safely.
Fortinet & RDP Entry
NightSpire typically breaks in through a FortiOS/FortiProxy authentication-bypass flaw or RDP access using valid or brute-forced credentials.
Double Extortion Pressure
Data is staged and stolen before encryption, then published, sold or used to threaten the victim on the group's leak site.
Fast Go-Based Encryptor
A Go executable appends .nspire to files and also encrypts data held in OneDrive without changing filenames or icons.
Short Payment Deadlines
Leak-site countdown timers set payment deadlines as short as 48 hours before publication.Why You Shouldn’t Attempt to Fix It Alone
BeforeCrypt checks for available decryption tools, including free ones, as part of every assessment. NightSpire’s encryptor has not been observed deleting Volume Shadow Copies, so VSS snapshots can sometimes support recovery, but an unverified or wrongly applied tool can make recovery harder, so anything found is tested on copies first.
NightSpire steals data before it encrypts, and its leak site publishes stolen files, sells them to third parties, or posts negotiation transcripts when a victim refuses to pay. Even if backups let you recover the files, the exposure itself is an additional risk for your business, separate from the file loss itself. Notification obligations depend on your sector and geography — see the FAQ below for the regulatory clocks that may apply.
BeforeCrypt provides full incident response where needed, or works alongside an existing IT team — forensic triage, containment, and establishing exactly what was taken. Where it’s the right option, this includes negotiation with the attackers — including reducing the demand and buying time — alongside sanctions screening before any payment, evidence preservation for insurers and regulators, and coordinated notification timelines. NightSpire has published negotiation transcripts and named non-paying victims on its leak site, and handling technical response, internal coordination, customer communication and attacker contact all at once strains most internal teams.
An experienced internal security team can handle substantial parts of the response itself. Our detailed emergency response plan walks through the sequence step by step. A free assessment call with our team helps you decide quickly which parts to keep in-house and where specialist support saves time.
NightSpire drops a file named readme.txt into every folder it encrypts, stating that data was both stolen and encrypted and warning against third-party recovery tools. Each note carries a unique victim UUID and directs contact through an OnionMail address, a qTox ID, or one of two Tor negotiation portals.
YOU MUST NOT ATTEMPT TO TOUCH, RESTORE OR OVERWRITE THE DATA.
Hit by Nightspire Ransomware? Take These Immediate Recovery Steps
If you’ve fallen victim to ransomware, follow these crucial steps:
Request 24/7 Ransomware Recovery Help
Get expert guidance to assess, contain, and recover safely.
Isolate Infected Systems
Disconnect infected devices to stop the spread. Avoid self-recovery.
Preserve Evidence Immediately
Keep ransom notes & logs. Do not restart or modify anything.
Nightspire ransomware statistics & facts
RANSOM SUMMARY
| Name | NightSpire (assessed rebrand of Rbfs) |
| Danger level | High. Fast, opportunistic double-extortion ransomware targeting small and mid-sized businesses worldwide. |
| Release date | 2025 (first observed February 2025) |
| OS affected | Windows; vendor research in July 2025 found that no cross-platform (Linux/ESXi) deployments had been observed |
| Appended file extensions | .nspire |
| Ransom note filename | readme.txt |
| Contact channels | OnionMail address, qTox ID, two Tor negotiation portals; also reported using Telegram, ProtonMail and Gmail |
COMMON ATTACK VECTORS
- Exploit Public-Facing Application (T1190) — abuse of CVE-2024-55591, an authentication bypass in FortiOS/FortiProxy that grants super-admin access to a FortiGate appliance
- Valid Accounts / External Remote Services (T1078/T1133) — RDP access obtained with valid or brute-forced credentials, sometimes held for days before deployment
- Remote Access Software (T1219) — AnyDesk and Chrome Remote Desktop installed for redundant persistence after initial access
- Phishing (T1566) — reported alongside RDP brute-forcing as an additional entry route
RANSOM AMOUNTS
NightSpire opportunistically targets small and mid-sized manufacturing, technology and professional-services firms worldwide, most often gaining entry through exposed FortiGate appliances or RDP.
NightSpire ransom demands range from $150,000 into the millions of dollars. Ransoms are usually paid in Bitcoin. Quick-buy methods of purchasing Bitcoin with PayPal or credit cards do not work for this size of ransom payment and it is important to obtain expert advice to ensure that a payment of this size is legally compliant.
Where negotiation is the right option, our experienced negotiation team has consistently secured meaningful reductions from the initial demand to the final settlement across NightSpire engagements.
AVERAGE LENGTH
NightSpire’s Go-based payload block-encrypts large files such as backups, virtual disks and databases in 1 MB chunks and also locks data held in OneDrive without renaming it, so recovery requires checking cloud storage alongside local systems before operations can resume.
For most ransomware victims, downtime is the most costly aspect of the incident, with potential for considerable reputational harm.
Our extensive experience with NightSpire ransomware gives us a deep understanding of the gang’s tactics, enabling us to resolve attacks swiftly and restore your files.
How to identify nightspire ransomware
NightSpire drops a file named readme.txt into every directory containing encrypted files, stating that data was stolen as well as encrypted and warning against third-party recovery tools. The note includes a unique victim UUID and directs contact through an OnionMail address, a qTox ID, or Tor negotiation portals.
Frequently asked questions
Decryption depends on the ransomware variant. In some cases, publicly available decryption tools exist, but not all attacks have a known solution. You can submit a free ransomware recovery request, and we will check for possible decryption methods.
In most cases involving personal data, which applies to nearly every ransomware incident, reporting is legally required. In the EU, GDPR requires notification to the relevant data protection authority within 72 hours of becoming aware of a personal data breach. The UK ICO requires the same 72-hour window. In the US, HIPAA-covered entities have 60 days to notify affected individuals (and immediately for breaches affecting 500+ people). The clock starts from awareness of the incident, not from a full technical understanding.
In most jurisdictions, paying a ransom is not illegal in itself — but it can become illegal if the payment ends up going to a sanctioned entity or country (OFAC-designated groups in the US, EU sanctions lists, UK Treasury lists). Before any payment, sanctions screening is essential. BeforeCrypt handles this compliance layer as a standard part of every engagement.
Most established ransomware groups do provide working decryption tools when paid — the business model depends on their reputation for delivery. However, decryptors are often slow, incomplete, or corrupt a percentage of files during recovery. This is where working with a specialist matters: BeforeCrypt tracks the delivery reliability of specific groups, negotiates sample-file decryption as proof of capability where the group allows it, and plans realistic recovery timelines based on our own engagement history with each group.
Most modern ransomware groups follow through on publication threats — stolen data appears on the group's leak site, is often mirrored to Telegram and dark web forums, and may be sold to third parties. Recovery becomes limited to whatever you can rebuild from backups.
Backups protect against file loss but not against data theft. Most modern ransomware groups exfiltrate sensitive data BEFORE encryption and threaten to publish it regardless of your recovery capability. This is why leak-site publication and negotiation still matter even for organisations with clean, offline backups — and why "we can just restore from backup" rarely tells the full story.
In most jurisdictions, yes — reporting is a standard part of a ransomware incident and, in some cases, legally required. In the US, that means the FBI (via IC3 or a local field office) and CISA. In the EU, national CERT and cybercrime units. Reporting does not obligate you to any specific recovery path but does open access to threat intelligence and, occasionally, decryption tools recovered by law enforcement.
Yes. We’ve handled 1,700+ incidents across ransomware, BEC and data-leak extortion. We identify the variant, decide decrypt vs. clean verified restore, and guide a controlled return to operations. When needed, we support negotiation & compliance—always legally and with a clear audit trail.
Yes. We produce insurer-ready incident reports with a defensible timeline, scope, likely entry path, exfiltration assessment, actions taken, and chain-of-custody. We can join the adjuster call, map our findings to your carrier’s forms, and provide GDPR/NIS2 notifications where required. Final acceptance always depends on the policy and carrier, but our packages are designed to speed up approvals and reduce back-and-forth.
MSPs keep IT running; they’re not built for evidence handling and incident triage. Insurer panels optimize claims, not necessarily speed & clarity for your business. We work alongside both: kick off in ≤2h, run forensic triage with chain-of-custody, coordinate safe containment, and deliver executive- and insurer-ready findings—without taking your environment hostage.
Because it turns chaos into fast, safe recovery. We cut downtime and limit damage while preserving evidence. Within ≤48h you get a forensic triage pack (timeline, likely entry path, scope, decrypt-vs-clean-restore decision, go-live criteria) so leadership can act with confidence. Result: controlled, verified restart—not guesswork.
