NightSpire is a ransomware group that emerged in March 2025, known for aggressive double-extortion with 2-day deadlines and over 250 victims.
Analyst brief
NightSpire is a ransomware group that emerged in March 2025, rapidly claiming over 250 victims across multiple sectors. It targets Manufacturing, Technology, Financial Services, and Education in countries including the US, India, Turkey, and Singapore. The group employs aggressive double-extortion tactics with extremely short ransom deadlines of just two days. Defenders should prioritize network segmentation, offline backups, and IOC monitoring for C2 infrastructure to prevent data exfiltration within the critical 48-hour window.
nightspire
activecrime
NightSpire is a ransomware group that first emerged in March 2025 and rapidly claimed over 250 victims across retail, manufacturing, healthcare, finance, and education sectors in the US, France, India, Taiwan, and Japan, using aggressive double-extortion with ransom deadlines as short as two days.
observed victims (by country)
United StatesIndiaTurkeyFrance
observed sectors
Not FoundManufacturingTechnologyProfessional Services