As cited
Copy frozen at (site build).
ransomware
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has tracked Storm-2570, a ransomware affiliate operating across multiple ransomware families including Qilin, DragonForce, Anubis, and BERT since April 2025. The group maintains consistent post-compromise tradecraft across deployments, using remote management tools like MeshAgent, discovery utilities such as Nmap and NetScan, credential theft techniques including Mimikatz and ntdsutil, and cloud exfiltration tools like s5cmd and Rclone before deploying ransomware. Defenders can detect and disrupt Storm-2570 activity by tracking recurring behaviors and infrastructure patterns rather than focusing solely on ransomware payloads.
Why it matters: Organizations in healthcare, education, government, finance, energy, and other sectors across North America and Europe face intrusions from this cross-ecosystem affiliate that exploits consistent tactics across multiple ransomware operations; security teams should monitor for MeshAgent deployments, PsExec lateral movement, Defender tampering, and S3 exfiltration activity to interrupt attacks before ransomware deployment.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ransomware
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has tracked Storm-2570, a ransomware affiliate operating across multiple ransomware families including Qilin, DragonForce, Anubis, and BERT since April 2025. The group maintains consistent post-compromise tradecraft across deployments, using remote management tools like MeshAgent, discovery utilities such as Nmap and NetScan, credential theft techniques including Mimikatz and ntdsutil, and cloud exfiltration tools like s5cmd and Rclone before deploying ransomware. Defenders can detect and disrupt Storm-2570 activity by tracking recurring behaviors and infrastructure patterns rather than focusing solely on ransomware payloads.
Why it matters: Organizations in healthcare, education, government, finance, energy, and other sectors across North America and Europe face intrusions from this cross-ecosystem affiliate that exploits consistent tactics across multiple ransomware operations; security teams should monitor for MeshAgent deployments, PsExec lateral movement, Defender tampering, and S3 exfiltration activity to interrupt attacks before ransomware deployment.
- Source published
- First seen by Cybersecurity Tracker