Microsoft Tracks Storm-2570's Ransomware Tradecraft Across Multiple Operations

Microsoft Threat Intelligence has published a report detailing the recurring tactics, techniques, and procedures (TTPs) of Storm-2570, a ransomware affiliate associated with multiple ransomware-as-a-service (RaaS) operations.

The report links Storm-2570 to deployments involving Qilin, DragonForce, Anubis, and BERT ransomware.

According to Microsoft, the affiliate has maintained largely consistent post-compromise behavior across these different ransomware ecosystems. Its activity includes remote access tooling, credential theft, network discovery, lateral movement, security tampering, and data exfiltration.

Microsoft has tracked Storm-2570 since April 2025 and says its investigations have identified activity affecting organizations across multiple countries and industries.

The findings highlight why defenders should investigate the behaviors and infrastructure behind ransomware incidents rather than focusing exclusively on the ransomware payload.

Even when the final malware changes, recurring tools and intrusion methods can help security teams connect related activity and identify attacks before encryption begins.

Who Is Storm-2570?

Storm-2570 is a ransomware affiliate that Microsoft Threat Intelligence assesses has operated across multiple RaaS ecosystems.

Microsoft has associated the actor with four ransomware families:

• Qilin

• DragonForce

• Anubis

• BERT

Unlike an affiliate operating within a single ransomware program, Storm-2570 appears to move across different operations.

Microsoft says this cross-ecosystem activity allows the actor to use different ransomware families while maintaining familiar post-compromise methods.

The company has observed Storm-2570 in investigated intrusions affecting organizations in the United States, Canada, the United Kingdom, Spain, the Netherlands, and Puerto Rico.

Reportedly affected sectors include healthcare and public health, education, government, financial services, energy, retail, information technology, food and agriculture, transportation, critical manufacturing, and other commercial and nonprofit organizations.

Microsoft's findings indicate that ransomware attribution based only on the deployed payload can obscure the affiliate responsible for the intrusion.

Storm-2570's Attack Chain: From Initial Access to Ransomware

Microsoft says the initial access method used by Storm-2570 remains unconfirmed.

However, investigations show a recurring sequence of activities after an attacker gains access to a network.

The observed pattern includes remote management tools, interactive command execution, internal discovery, credential access, lateral movement, data theft, and ransomware deployment.

Microsoft emphasizes that these activities can appear across different ransomware deployments, making them useful indicators for defenders investigating an intrusion.

Overview of the Observed Attack Chain

Initial access, method unconfirmed → Remote access and persistence → Network discovery and credential access → Defense evasion → Lateral movement → Data exfiltration → Ransomware deployment

The sequence represents a recurring pattern described by Microsoft, not a mandatory order followed in every incident.

Remote Management Tools Provide Persistent Access

Microsoft identifies remote monitoring and management (RMM) software as a recurring part of Storm-2570's post-compromise activity.

The actor uses commercially available remote administration tools to execute commands, maintain access, deploy additional software, and interact with compromised systems.

Tools observed by Microsoft include:

• Atera

• MeshAgent and MeshCentral

• ScreenConnect

• Splashtop

• Remotely_Agent

• NinjaRMM

These tools have legitimate administrative uses. Their presence alone does not establish malicious activity.

However, Microsoft says Storm-2570 repeatedly uses them as part of its intrusion operations.

MeshAgent and MeshCentral

MeshAgent is one of the most frequently observed remote access and execution tools in the report.

Microsoft says Storm-2570 often deploys MeshAgent after gaining access, using it to expand control, execute commands, and prepare for later stages of an attack.

In some incidents, the actor uses MeshAgent alongside MeshCentral as a bridge between initial interactive activity and subsequent actions such as account manipulation, discovery, credential access, and ransomware deployment.

Microsoft has also observed the actor renaming MeshAgent-related binaries and services to include the name of the compromised organization.

For example, a binary may use a naming pattern such as:

meshagent64-[organization name].exe

The report also describes the use of Base64 encoding to obfuscate commands.

In one investigated incident, MeshAgent was used alongside NinjaRMM before the actor proceeded to Active Directory credential dumping, network scanning, and Qilin deployment.

Multiple RMM Tools in the Same Intrusion

Storm-2570 does not rely on a single remote access platform.

Microsoft has observed the actor using Atera to install agents and execute commands, then downloading and installing Splashtop Streamer for interactive remote control.

Other observed tools include ScreenConnect for command execution and reconnaissance, and Remotely_Agent for persistent remote management.

The combination of multiple remote access tools can make it harder for defenders to identify the full scope of an intrusion by monitoring only one software family.

Tunneling Utilities Help Maintain Remote Connectivity

Microsoft has observed Storm-2570 using tunneling utilities such as ngrok and Cloudflared.exe to establish remote access paths.

In one investigated incident, the actor installed MeshAgent and later created a persistent Cloudflare Tunnel service on a compromised host.

The tunnel was configured to run automatically as a service under the LocalSystem account.

Microsoft says this type of outbound connection can provide a remote access channel from inside a network while avoiding the need for an externally accessible inbound connection.

The report also describes the use of ngrok to expose Remote Desktop Protocol (RDP) services.

These activities illustrate how remote management tools and tunneling utilities can work together to sustain access and support follow-on operations.

Network Discovery and Credential Theft

After establishing access, Storm-2570 conducts internal network discovery to identify reachable systems, services, network shares, and potentially valuable files.

Microsoft has observed the use of:

• NetScan

• SoftPerfect Network Scanner Portable

• Nmap

• Native Windows discovery commands

The actor uses these tools to map the environment and identify systems that may support credential theft, data collection, or ransomware deployment.

Credential Access Tools

Microsoft reports that Storm-2570 uses several tools to collect credentials:

• Mimikatz

• LaZagne

• pypykatz

• Windows ntdsutil.exe

The report describes the use of ntdsutil.exe to create an Install From Media (IFM) copy of Active Directory database material.

This process can involve staging the NTDS.dit database and supporting registry hives for subsequent extraction of domain credential material.

Microsoft says the observed command pattern is consistent with creating an IFM backup in a temporary directory.

In an intrusion, an attacker with sufficient privileges could use the staged material to extract password hashes and other credential information offline.

The activity indicates that the actor has obtained high-privilege access to the affected domain controller.

Defense Evasion: Tampering With Security Controls

Microsoft says Storm-2570 frequently attempts to weaken endpoint protection before ransomware deployment.

Observed activities include:

• Disabling Microsoft Defender real-time monitoring

• Adding antivirus exclusions for C:\PerfLogs

• Modifying registry values associated with Microsoft Defender

• Altering settings related to Defender service behavior

The report identifies activity involving registry values such as:

• DisableAntiSpyware

• DisableRealtimeMonitoring

• WinDefend

Microsoft says these techniques have appeared in intrusions involving Qilin, DragonForce, and Anubis ransomware.

The purpose of these changes is to impair security protections and reduce the likelihood that malicious activity will be detected or blocked.

For defenders, attempts to disable security controls or create unexpected exclusions can provide important signals of a broader intrusion.

Lateral Movement and Ransomware Preparation

After obtaining credentials and weakening security controls, Storm-2570 moves across compromised environments using a combination of legitimate administrative tools and offensive utilities.

Microsoft has observed the use of:

• PsExec

• Impacket

• NetExec

• RDP batch scripts

• Administrative network shares

These tools allow the actor to execute commands remotely, reach additional systems, and distribute tools across a network.

PsExec and Renamed MeshAgent Deployments

Microsoft identifies PsExec as one of Storm-2570's most consistent lateral movement and deployment tools.

The actor sometimes uses host lists such as @ip.txt to target multiple systems.

In several investigations, PsExec was used to install renamed MeshAgent binaries on additional compromised machines.

This allows the actor to expand remote access beyond the initial host.

RDP Access and Firewall Changes

Storm-2570 also uses scripts to enable Remote Desktop access.

Microsoft describes an rdp.bat script that modifies Terminal Server settings and adds a firewall rule permitting TCP port 3389, the default RDP port.

In some incidents, PsExec was used to execute the script across multiple hosts.

The report also describes ngrok being used to expose RDP services, followed by PsExec-related activity and security tampering.

These techniques illustrate how the actor combines remote desktop access, tunneling, and remote execution to maintain control and move through a network.

Impacket and NetExec Over SMB

Microsoft has also observed Storm-2570 using Impacket and NetExec over Server Message Block (SMB).

Impacket is an open-source collection of Python classes for working with network protocols. Its capabilities can support a range of administrative and security testing tasks, but attackers can also use it for lateral movement and remote execution.

Microsoft recommends using attack surface reduction protections and limiting lateral movement pathways to help defend against these techniques.

Data Collection and Exfiltration Through Cloud Storage

Microsoft says Storm-2570 frequently steals data before deploying ransomware.

The actor uses cloud and file-transfer utilities to collect files from compromised systems and transfer them to attacker-controlled destinations.

Two tools feature prominently in the report:

• s5cmd

• Rclone

s5cmd and S3-Based Exfiltration

Microsoft identifies s5cmd as a commonly used tool for Storm-2570's data exfiltration activity.

The command-line utility supports operations with Amazon S3 and compatible object storage services.

According to Microsoft, the actor has staged s5cmd.exe alongside a credentials file and used it to transfer selected files to attacker-controlled S3 buckets.

The targeted data can include:

• Documents and spreadsheets

• Images

• Databases

• Mail-related files

• Archives

• Other business-related files

The report describes the actor identifying valuable drives and network shares, staging the transfer utility and credentials, and then using file-extension filters to select data for copying.

The credentials file stores AWS access keys used to authenticate to the destination storage service.

Rclone and Continuous Data Transfer

Microsoft has also observed Storm-2570 using Rclone for data theft.

Rclone is a file synchronization utility that can move files to cloud storage and other supported destinations.

Microsoft says the actor can use it to transfer newly created or updated files in near real time, supporting continued data collection throughout an intrusion.

Double Extortion

The combination of data theft and ransomware deployment supports a double-extortion approach.

In this model, attackers first collect sensitive information and then deploy ransomware to encrypt systems.

The stolen data can provide an additional source of leverage beyond the disruption caused by encryption.

Microsoft's findings highlight why defenders should monitor suspicious data transfers and cloud storage activity before ransomware is deployed.

What Storm-2570's Activity Means for Defenders

Microsoft says Storm-2570 demonstrates how ransomware affiliates can maintain consistent operational methods while moving between different ransomware programs.

The actor's use of common administrative tools, remote access software, credential theft utilities, and cloud-transfer applications means that defenders should not rely exclusively on ransomware-specific indicators.

Instead, Microsoft recommends examining activity across the full attack chain.

Several recurring behaviors can help security teams identify suspicious activity before encryption:

• Unexpected installation of remote management software

• Renamed MeshAgent binaries or services

• Unusual tunneling services and remote desktop exposure

• Credential dumping and Active Directory database staging

• Attempts to disable endpoint protection

• PsExec-based execution across multiple hosts

• Unexpected use of s5cmd or Rclone for data transfers

These behaviors are not exclusive to Storm-2570. Many tools have legitimate uses, so investigations should consider context, account activity, system changes, and the sequence of events.

The broader defensive lesson is that ransomware detection should include the activities that make deployment possible, not only the final payload.

Microsoft's Mitigation and Protection Recommendations

Microsoft recommends several measures to reduce exposure to Storm-2570's techniques and similar ransomware activity.

1. Strengthen Credential Hygiene and Limit Lateral Movement

Organizations should follow ransomware defense guidance focused on credential protection and the principle of least privilege.

Limiting unnecessary administrative access can make it harder for an attacker to move from one compromised system to others.

2. Enable Tamper Protection

Microsoft recommends enabling tenant-wide tamper protection to help prevent attackers from disabling security services or modifying antivirus exclusions.

Organizations using Intune or Microsoft Defender for Endpoint security configuration can also enable DisableLocalAdminMerge to prevent local Group Policy changes from modifying antivirus exclusions.

Microsoft additionally recommends configuring always-on Microsoft Defender Antivirus protection through Group Policy where appropriate.

3. Secure Approved Remote Management Tools

Organisations should review the remote management software authorized for use in their environments.

Microsoft recommends enforcing security settings, including multifactor authentication where supported.

If an unapproved RMM installation is discovered, organizations should reset passwords for accounts used to install the software.

If the software was installed using a system-level account, Microsoft recommends further investigation.

4. Configure Automatic Attack Disruption

Microsoft recommends enabling automatic attack disruption in Microsoft Defender XDR.

The capability is designed to contain attacks in progress, limit the impact on organizational assets, and give security teams more time to complete remediation.

5. Enable Attack Surface Reduction Rules

Microsoft recommends enabling relevant attack surface reduction (ASR) rules to help block techniques commonly used in ransomware attacks.

The listed protections include:

• Block credential stealing from the Windows Local Security Authority Subsystem Service (lsass.exe)

• Block execution of potentially obfuscated scripts

• Block webshell creation on servers

• Block process creation originating from PsExec and WMI commands

• Block the use of copied or impersonated system tools

• Use advanced protection against ransomware

Microsoft notes that the PsExec and WMI rule may cause compatibility issues on certain server systems. Organizations should evaluate deployment requirements and apply the rule where appropriate.

Microsoft Defender Detection Coverage

Microsoft lists detection coverage across Microsoft Defender Antivirus and Microsoft Defender for Endpoint for activity associated with Storm-2570.

The following table summarizes the detection areas described in the report.

Microsoft notes that Defender coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications.

The detection names and coverage listed in the source are specific to Microsoft's security products and should not be interpreted as a guarantee that every instance of the activity will be detected.

Microsoft Security Copilot and Threat Intelligence Resources

Microsoft also highlights the role of Microsoft Security Copilot in helping security teams investigate and respond to threats.

According to the report, Security Copilot is integrated into Microsoft Defender and supports tasks such as:

• Summarizing security incidents

• Analyzing files and scripts

• Summarizing identity-related information

• Generating hunting queries and incident reports

• Supporting guided response workflows

Microsoft also lists AI agents available to assist with security tasks, including threat intelligence briefing, phishing triage, threat hunting, and dynamic threat detection.

The report points Microsoft Defender XDR customers to threat analytics resources for Storm-2570 and the associated ransomware families.

These resources include:

• Storm-2570 Actor Profile

• Qilin Ransomware Tool Profile

• Anubis Ransomware Tool Profile

• DragonForce Ransomware Tool Profile

Access to some threat analytics reports requires a qualifying Microsoft Defender XDR license.

Threat Hunting Queries for Storm-2570 Activity

Microsoft provides advanced hunting queries for Microsoft Sentinel customers to investigate activity associated with Storm-2570.

The source includes two queries: one for PsExec-based remote execution and another for renamed MeshAgent binaries and services.

These queries can help security teams search for activity matching the patterns described in the report.

Query 1: Hunt for PsExec-Based Remote Execution

The query searches DeviceProcessEvents for PsExec executables and command-line patterns associated with remote execution and deployment.

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("psexec.exe", "psexec64.exe")
    or ProcessCommandLine has_any ("psexec.exe", "psexec64.exe")
| where ProcessCommandLine has_any ("@ip.txt", "-accepteula", "\\")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          SHA256, DeviceId, ReportId
| order by Timestamp desc

What it does: The query searches the previous 30 days of process events for PsExec-related activity, filters for selected command-line patterns, and returns process, device, account, and hash details for investigation.

Query 2: Hunt for Renamed MeshAgent Binaries and Services

The second query searches process, file, and registry events for references to MeshAgent and MeshCentral.

let MeshAgentTerms = dynamic(["meshagent", "meshagent64", "meshcentral"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName has_any (MeshAgentTerms)
        or ProcessCommandLine has_any (MeshAgentTerms)
        or InitiatingProcessCommandLine has_any (MeshAgentTerms)
    | project Timestamp, DeviceName, ActionType, FileName, FolderPath,
              ProcessCommandLine, InitiatingProcessFileName,
              InitiatingProcessCommandLine, SHA256,
              RegistryKey="", RegistryValueName="", SourceTable="DeviceProcessEvents"
),
(
    DeviceFileEvents
    | where Timestamp > ago(30d)
    | where FileName has_any (MeshAgentTerms)
        or FolderPath has_any (MeshAgentTerms)
        or InitiatingProcessCommandLine has_any (MeshAgentTerms)
    | project Timestamp, DeviceName, ActionType, FileName, FolderPath,
              ProcessCommandLine="", InitiatingProcessFileName,
              InitiatingProcessCommandLine, SHA256,
              RegistryKey="", RegistryValueName="", SourceTable="DeviceFileEvents"
),
(
    DeviceRegistryEvents
    | where Timestamp > ago(30d)
    | where RegistryKey has_any (MeshAgentTerms)
        or RegistryValueName has_any (MeshAgentTerms)
        or RegistryValueData has_any (MeshAgentTerms)
        or InitiatingProcessCommandLine has_any (MeshAgentTerms)
    | project Timestamp, DeviceName, ActionType, FileName="", FolderPath="",
              ProcessCommandLine="", InitiatingProcessFileName,
              InitiatingProcessCommandLine, SHA256="",
              RegistryKey, RegistryValueName, SourceTable="DeviceRegistryEvents"
)
| order by Timestamp desc

What it does: The query combines process, file, and registry events to identify references to MeshAgent-related terms across the previous 30 days. The results include the source table and relevant event fields to help analysts investigate possible remote management activity.

These queries are starting points for threat hunting. Their results require contextual investigation because remote management tools can also be used for legitimate administration.

What the Storm-2570 Findings Mean for Ransomware Defense

The Storm-2570 report highlights a recurring challenge in ransomware investigations: the ransomware family may change while the underlying intrusion methods remain similar.

Microsoft's findings connect the affiliate to multiple ransomware ecosystems while documenting repeated use of remote management tools, credential access utilities, lateral movement techniques, security tampering, and cloud-based data exfiltration.

For security teams, this reinforces the importance of monitoring the entire attack chain.

Detecting unauthorized remote access, credential dumping, suspicious administrative activity, and unusual data transfers may provide opportunities to investigate and disrupt an intrusion before ransomware deployment.

The report also illustrates the value of correlating activity across endpoints, identities, network systems, and cloud services rather than treating each alert or malware family as an isolated event.

The announcement highlights a broader defensive shift toward behavior-based threat detection, where recurring attacker techniques can reveal connections across different ransomware operations.

Microsoft's recommendations focus on reducing unnecessary privileges, protecting security controls, securing remote management software, limiting lateral movement, and using threat hunting to investigate suspicious activity.

Conclusion

Microsoft Threat Intelligence's report identifies Storm-2570 as a ransomware affiliate associated with Qilin, DragonForce, Anubis, and BERT deployments.

Despite the use of different ransomware payloads, Microsoft has observed recurring methods involving remote access tools, credential theft, security tampering, lateral movement, and data exfiltration.

The report provides mitigation guidance, Microsoft Defender detection coverage, and Sentinel hunting queries to help organizations investigate similar activity.

Its central finding is that understanding the affiliate's behavior across the attack chain can provide defenders with useful opportunities to identify and respond to ransomware activity before the final payload is deployed.