IIS Servers Under Siege: How Spirals Ransomware Exposes the RMM Time-Gap

There is a new nightmare for sysadmins managing Windows environments, and it moves fast. Spirals ransomware, written in Rust for efficiency and evasion, is tearing through internet-facing IIS servers. The attack timeline is terrifyingly short: initial breach to full network encryption in under 24 hours.

The attackers gain entry via web shells, interact directly with the IIS worker process, and—crucially—enable the Remote Desktop Protocol (RDP) to lock in their persistence. For the IT pro, this isn't just a security headline; it's a Tuesday morning alert demanding immediate, aggressive intervention. The problem isn't just the malware itself; it's the operational friction that gives the malware the time it needs to win.

The Problem: The "Switching Cost" is a Security Liability

Let's look at the standard operational reality for most IT departments and MSPs. You likely have a stack of disconnected tools:

1. Infrastructure Monitor: Alerts you that the IIS server CPU is spiking or memory is acting erratic (a symptom of the web shell/encryption process).
2. RMM Tool: Allows you to remote into the box to investigate.
3. Helpdesk/PSA: Where the ticket finally gets logged when a user complains the site is down.

When the Spirals ransomware hits, every second counts. The attackers move from web shell to privilege escalation to RDP enablement rapidly. If your workflow requires you to see an alert in Tool A, log in to Tool B to remote control the endpoint, and then manually update a ticket in Tool C, you are losing the race.

This "tab-switching" latency is a massive vulnerability. In the time it takes to authenticate to your RMM platform, the threat actors have likely already bypassed UAC and enabled RDP. By the time you are actually looking at the desktop, the encryption process may have already begun. Tool sprawl isn't just annoying; it's slow, and against Spirals, slow is fatal.

How AlertMonitor Solves This: Unified RMM and Monitoring

AlertMonitor eliminates the latency between detection and action by integrating monitoring, alerting, and RMM capabilities into a single, unified dashboard. We don't just notify you that an IIS server is under attack; we hand you the tools to stop it immediately, within the same interface.

The AlertMonitor Workflow:

When AlertMonitor detects the anomaly associated with a Spirals attack—such as a suspicious IIS worker process spawning or unauthorized RDP enablement—the workflow is instantaneous:

1. Unified Alerting: You receive a high-severity alert in the NOC dashboard that directly correlates the metric spike with the endpoint.
2. Instant Remote Access: With one click, you initiate an RMM session directly from the alert card. No separate login, no VPN struggles, no hunting for the asset ID in a different database.
3. Scripted Remediation: You can instantly push a PowerShell script across the device group to disable RDP or stop the IIS service if suspicious activity is confirmed. The script output feeds back into the timeline.

This unified approach collapses the "time-to-respond." Instead of a 40-minute gap between an alert and a technician accessing the console, you are looking at the data and controlling the endpoint in seconds. For the Spirals ransomware, which relies on speed to outpace IT responders, removing this operational friction is often the difference between a contained incident and a total network encryption.

Practical Steps: Auditing RDP and IIS Security

In the context of the Spirals attack, proactive management is key. Since the malware enables RDP for persistence, IT teams should regularly audit their IIS servers to ensure RDP is strictly disabled unless absolutely necessary.

Using AlertMonitor's integrated RMM scripting feature, you can deploy the following PowerShell script to your web server group immediately. This script checks the RDP status and looks for recent incoming network connections that might indicate a breach.

# Spirals Ransomware Audit Script
# Checks for RDP Status and Recent Events

# 1. Check if RDP is Enabled (Persistence Mechanism)
$fDenyTSConnections = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
if ($fDenyTSConnections -eq 0) {
    Write-Host "[CRITICAL] RDP is ENABLED on this IIS Server. Review immediately." -ForegroundColor Red
} else {
    Write-Host "[INFO] RDP is Disabled." -ForegroundColor Green
}

# 2. Check for recent unexpected services (Common with Web Shells)
$suspiciousServices = Get-WmiObject Win32_Service | Where-Object { $_.PathName -like "*w3wp.exe*" -and $_.State -eq 'Running' }
if ($suspiciousServices) {
    Write-Host "[WARNING] Found services running under w3wp.exe context:" -ForegroundColor Yellow
    $suspiciousServices | Select-Object Name, PathName, State
} else {
    Write-Host "[INFO] No anomalous services detected."
}

# 3. Pull the last 5 Security Events for Logon Type 10 (Remote Interactive)
Write-Host "--- Recent RDP Logon Attempts (Type 10) ---"
try {
    $events = Get-WinEvent -LogName Security -MaxEvents 10 -ErrorAction SilentlyContinue | Where-Object { $_.Id -eq 4624 -and $_.Message -match 'Logon Type:\s*10' }
    if ($events) {
        $events | Select-Object TimeCreated, @{Label='User';Expression={$_.Properties[5].Value}}, @{Label='Source IP';Expression={$_.Properties[19].Value}} | Format-Table -AutoSize
    } else {
        Write-Host "No recent Type 10 logons found."
    }
} catch {
    Write-Host "Error retrieving security logs: $_"
}

By running this via AlertMonitor's RMM, the results are recorded in the device history, creating an audit trail that proves your due diligence without requiring you to remote into every single server manually.

Related Resources

AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources