NightSpire is a Go-based encryptor that appends .nspire to affected files and leaves a plain-text note named readme.txt. The note is addressed to company management, lists the compromise, data theft and encryption as three bullet points, and gives an onion address plus a Proton Mail contact; it warns against renaming files or trying recovery software. Large file types such as disk images, backups and database files are encrypted in 1 MB blocks rather than whole. Activity began in early 2025 and has hit small and mid-sized firms in manufacturing, healthcare, professional services and construction across the Americas, Europe and East Asia, with South Korea, Japan and Taiwan prominent. Intrusions have used a FortiOS authentication bypass for entry, remote-access tools for persistence, and cloud sync utilities to move data out before encryption, feeding a Tor leak site. Lineage is not established.
File extensions: .nspire
Ransom note filenames: readme.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161