Microsoft has revealed a cybercrime affiliate known as Storm-2570 behind ransomware attacks that deploy different malware families but rely on a consistent attack strategy. The group has been active since approximately April 2025, targeting organizations in the U.S., Canada, the U.K., Spain, the Netherlands, and Puerto Rico. Its victims span sectors including healthcare, education, energy, and manufacturing.
How Storm-2570 operates
The group’s method starts after gaining initial access—though how that access is obtained remains unconfirmed. From there, Storm-2570 installs remote management tools like MeshAgent (often under a deceptive filename mimicking the victim organization), MeshCentral, Atera, NinjaRMM, ScreenConnect, Splashtop, or Remotely_Agent. These tools enable attackers to maintain persistent control. Tunneling technologies like Cloudflare Tunnel and ngrok have been used to maintain remote desktop access or create encrypted outbound connections, blending into regular admin traffic.
With control established, the attackers scan the network, locate credentials via tools such as Mimikatz, LaZagne, and pypykatz, and dump data from Active Directory. Afterwards, they take steps to weaken security defenses—disabling antivirus, tampering with registry settings, deploying remote execution methods via PsExec, Impacket, NetExec, or leveraging remote desktop scripting—to spread across further systems.
Data exfiltration before encryption
Before any ransomware is deployed, Storm-2570 often steals valuable files: documents, spreadsheets, databases, archives. These are moved to cloud storage using utilities like s5cmd for one-time transfers or Rclone for ongoing synchronization. The extortion risk remains since stolen data can stay exposed even after any ransomware encryption is remedied.
Across different infections, the final ransomware payload varies: Qilin, DragonForce, Anubis, or BERT have all been used. Because the initial phases of intrusion are so consistent, security teams may recognize the group’s involvement well before the ransom note appears.
Detection and defense tips
Microsoft advises several preventative steps: reduce privileged accounts, enforce strong credential hygiene, protect security settings from tampering, require multifactor authentication for remote management tools, investigate any unexpected agent installations, reset credentials tied to those agents, and monitor for suspicious cloud transfers or remote desktop activations. Unusual combinations of signs—unexpected remote tools, credential dumping, disabled antivirus, cloud uploads—are especially suspicious.
While Microsoft did not disclose total victim or financial loss figures, it emphasized the danger of focusing solely on the ransomware used, rather than the earlier stages of intrusion. Identifying attack markers or indicators of compromise early provides better defense.
This development matters because Storm-2570’s playbook shows how ransomware groups are becoming more modular—reusing tactics across multiple malware platforms. For defenders, the lesson is clear: it’s not just about the encryption payload. Recognizing recurring behavior across operations—remote tool use, credential theft, cloud exfiltration—can allow security teams to shut down threats before they reach their most damaging phase. Going forward, threat intelligence sharing and proactive log monitoring will be key in staying ahead of such adaptable adversaries.
