Buy Me a Coffee

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Nightspire

| Active | RaaS

None

External information

https://www.s-rminform.com/latest-thinking/ransomware-in-focus-meet-nightspire?utm_campaign=10511277-Meet_nightspire_Ransomware_in_Focus

Victims

122

First Discovered

victim

2025-03-12

Last Discovered

victim

2026-01-29

Inactive Since

in days

4

Avg Delay

between attack and claim

7.7 days

Infostealer

for victim with domain

12.5%

View Victims on World Map

View group statistics

Known Locations (10)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN
	NightSpire		No	2025-06-01 21:19:00		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
	Index of /data		No	2025-06-01 21:19:06		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
	NightSpire		No	2025-06-01 21:19:14		`nspireyzmvapgiwgtuoznlafqvlyz7ey6himtgn5bdvdcowfyto3yryd.onion`
	404 Not Found		No	2026-02-02 19:31:16	nginx	`a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion`
	NightSpire		No	2026-02-02 19:33:48	nginx	`a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion`
	RaaS Service Started \| NightSpire		No	2026-02-02 19:35:22		`nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion`
	Database \| NightSpire		No	2026-02-02 19:35:30		`nspirebcv4sy3yydtaercuut34hwc4fsxqqv4b4ye4xmo6qp3vxhulqd.onion`
	RaaS Service Started \| NightSpire		No	2026-02-02 19:35:41		`nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion`
	Database \| NightSpire		No	2026-02-02 19:35:53		`nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion`
	Verify human - NightSpire		Yes	2026-02-02 18:38:42	nginx 1.26.3	`nspire7lugml7ybqyjaaxtsgrs4qn3fcon3lrjbih6wamttvdm5ke4qd.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (3)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Everything.exe placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	placeholder placeholder	MEGA WinSCP

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (0)

YARA Rules (0)

Indicators of Compromise (IoCs) (7)

EMAIL 4 TELEGRAM 2 TOX 1

Type	IOC
`email`	`night.spire.team@gmail.com`
`email`	`night.spire.team@onionmail.org`
`email`	`night.spire.team@proton.me`
`email`	`nightspireteam.receiver@onionmail.org`
`telegram`	`https://t.me/night_spire_team`
`telegram`	`@nightspireteam2025`
`tox`	`8D663FD10BF662930F4C076CBF95FACFCC4ABD8F1A5E328DE75D0B0237A74E1AE1E0C5C37E7F`

Victims (122)