Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence operating across multiple Ransomware as a Service ecosystems, including Qilin, DragonForce, Anubis, and BERT. This actor has been observed in intrusions targeting organizations across numerous sectors, including healthcare, government agencies, financial services, and IT. The actor exhibits consistent tradecraft, infrastructure overlaps, and repeated use of the same remote access and cloud exfiltration tooling despite operating across different ransomware payloads.
The intrusion chain involves leveraging various commodity tools for pre-ransom stages, such as RMM software (e.g., Atera, MeshAgent) for remote management, NetScan/Nmap for discovery, Mimikatz/ntdsutil for credential access, and s5cmd/Rclone for data exfiltration. A frequently observed tool is MeshAgent, which the actor tailors by renaming binaries and using Base64 encoding for commands. The actor utilizes a mix of tools, including tunneling utilities like Cloudflared.exe to establish persistent outbound access. Lateral movement involves leveraging PsExec, Impacket, NetExec, and RDP batch scripts alongside remote access methods. Defense evasion tactics include tampering with Microsoft Defender settings, such as disabling real-time monitoring and modifying registry values to impair security protections.

* Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025.
* The actor has operated across RaaS ecosystems including Qilin, DragonForce, Anubis, and BERT.
* Observed intrusions affected organizations in the United States, Canada, United Kingdom, Spain, Netherlands, and Puerto Rico.
* Observed sectors include healthcare, government, financial services, education, energy, and IT.
* Intrusion chains involved use of Remote Monitoring and Management (RMM) tools such as Atera, MeshAgent, ScreenConnect, Splashtop, RemotelyAgent, and NinjaRMM.
* Discovery and lateral movement tools included NetScan, Nmap, PsExec, Impacket, NetExec, and RDP batch scripts.
* Data collection and exfiltration tools included s5cmd and Rclone.
* Credential access utilized Mimikatz, LaZagne, pypykatz, and ntdsutil for NTDS.dit dumping.
* Defense evasion involved disabling real-time monitoring and modifying Microsoft Defender settings.
* Lateral movement utilized PsExec, Impacket, NetExec, RDP batch scripts, and admin shares.
* Exfiltration tools observed include s5cmd for S3-based transfer.

The narrative emphasizes that the operational consistency of Storm-2570 across disparate ransomware payloads highlights a shift in threat actor focus from brand identity to reproducible operational tradecraft. The persistence and iterative use of specific toolsets—particularly MeshAgent for remote access, combined with specific lateral movement tools like PsExec and Impacket—suggests an organizational layer within the affiliate structure that mandates standardized post-compromise procedures, irrespective of the final payload delivered. This pattern suggests that the value resides not in the specific ransomware chosen but in the repeatable methodology used to maximize control and extraction following initial access.
The reliance on blending legitimate administrative tools (like MeshAgent) with obfuscation techniques (renaming binaries, Base64 encoding) creates a layered defense challenge; defenders must focus less on identifying specific malware signatures and more on monitoring anomalous sequences of legitimate tool usage that bridge the gap between remote administration and final impact. Furthermore, the documented focus on credential harvesting via native AD tools like ntdsutil and the consistent use of cloud-based transfer utilities for data exfiltration points to a core operational assumption: high-value assets are accessible through standard administrative interfaces.
The existence of specific hunting queries in Microsoft Sentinel that target named tool executions (PsExec, MeshAgent) demonstrates that threat intelligence is already translating complex behavioral observations into actionable detection logic. The implication is that cognitive sovereignty demands shifting from reactive signature matching to proactive mapping of these interconnected tool chains; understanding the dependency between remote access, credential harvesting, and exfiltration allows defenders to interrupt the attack flow at critical junctures, rather than simply reacting to the final ransomware event. What assumptions about the actor's intent regarding this operational uniformity are we making when we treat TTPs as a static playbook?