Nightspire Syndicate Dossier

Emerging in early 2025 as an apparent successor to the Rbfs operation, NightSpire is a double-extortion ransomware threat targeting enterprises across manufacturing, professional services, healthcare, and education. Developed in Go (Golang) and appending the .nspire extension, the malware employs living-off-the-land techniques using utilities such as Everything for file discovery, 7-Zip for compression, and MEGAsync for high-volume data exfiltration. The syndicate gains initial compromise primarily through edge infrastructure exploits—specifically Fortinet FortiOS/FortiProxy devices (such as CVE-2024-55591)—and exposed Remote Desktop Protocol (RDP) access.