Threat Intelligence is tracking Storm-2570, a ransomware affiliate linked to attacks involving Qilin, DragonForce, Anubis, and BERT.
Although the ransomware payload changes, Microsoft says the actor repeatedly uses similar tools and techniques. That pattern gives defenders a way to connect intrusions before encryption begins.
Microsoft has tracked Storm-2570 since April 2025. Its investigations span organizations in the United States, Canada, the United Kingdom, Spain, the Netherlands, and Puerto Rico.
Affected sectors include healthcare, education, government, finance, energy, manufacturing, and transportation. Microsoft has not confirmed how the actor initially gains access.
Storm-2570 Linked to Ransomware
After gaining a foothold, Storm-2570 uses remote monitoring and management tools to control systems and run commands. MeshAgent appears frequently across the investigated intrusions.
The actor sometimes renames its binaries or services to include the victim organization’s name, making the software look more familiar to administrators. Other observed tools include Atera, ScreenConnect, Splashtop, Remotely_Agent, and NinjaRMM.
Storm-2570 also uses ngrok and Cloudflared.exe to maintain remote access. In one intrusion, the actor installed a Cloudflare Tunnel as a service running under LocalSystem, creating an outbound connection that could remain available for follow-on activity.
The affiliate then maps the network with tools such as NetScan and Nmap. For credential theft, Microsoft observed Mimikatz, LaZagne, pypykatz, and the Windows utility ntdsutil.
The latter can create a copy of Active Directory database material, including NTDS.dit, that attackers can use to extract domain credentials offline.
With greater access, Storm-2570 uses PsExec, Impacket, NetExec, administrative shares, and Remote Desktop Protocol scripts to reach other machines.
It has also changed Microsoft Defender settings, disabled real-time monitoring, and added antivirus exclusions before ransomware deployment.
Microsoft says Storm-2570 often steals data before deploying ransomware. The actor uses s5cmd to copy selected files to S3-compatible storage and has also used Rclone for transfers.
Documents, spreadsheets, databases, archives, and mail-related files are among the targeted data types. This sequence supports double extortion, attackers can threaten to release stolen information while also demanding payment to restore encrypted systems.
The recurring behavior matters more than the ransomware name alone. An unauthorized MeshAgent installation, a newly created outbound tunnel, NTDS.dit collection, PsExec activity across multiple hosts, or unusual s5cmd transfers could indicate an intrusion even when defenders cannot identify the final payload.
None of these tools is inherently malicious, so investigators should assess them in context. Microsoft recommends restricting unnecessary administrator privileges, securing approved remote management tools with multifactor authentication, and investigating unapproved installations.
It also advises enabling tamper protection and relevant attack surface reduction rules to make credential theft, security disabling, and lateral movement harder.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
