Actor Profile

Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025. Unlike actors that consistently support a single ransomware operation, Storm-2570 operates as a cross-ecosystem threat actor working with multiple ransomware-as-a-service (RaaS) platforms including Qilin, DragonForce, Anubis, and BERT. The actor shifts between operations as opportunities arise, maintaining flexibility to deploy multiple ransomware families and improve payout opportunities. Storm-2570 demonstrates consistent post-compromise tradecraft, infrastructure overlaps, and repeated use of the same remote access and cloud exfiltration tooling despite operating across multiple ransomware ecosystems. This behavior pattern allows the same actor, tools, and intrusion methods to appear in different incidents despite different ransomware payloads being deployed.

TTPs (Tactics, Techniques, Procedures)

Storm-2570 employs commodity tools throughout the attack chain. For remote access and persistence, the actor heavily relies on RMM tools including MeshAgent/MeshCentral, Atera, ScreenConnect, Splashtop, Remotely_Agent, and NinjaRMM, often renaming binaries with victim-themed names and using Base64 encoding for obfuscation. Discovery and lateral movement leverage NetScan, Nmap, PsExec, Impacket, NetExec, and RDP batch scripts. Credential access includes ntdsutil for credential dumping. Data exfiltration utilizes s5cmd and Rclone for cloud-based data theft. The actor demonstrates hands-on-keyboard activity with tailored deployments customized to compromised environments. Security tampering occurs before ransomware deployment. The attack chain progresses from initial access through remote management tooling, credential access, lateral movement, exfiltration, and ultimately ransomware deployment.

Targets & Patterns

Storm-2570 has been observed in multiple intrusions affecting organizations across the United States, Canada, United Kingdom, Spain, Netherlands, and Puerto Rico. The actor demonstrates broad targeting across diverse sectors including healthcare and public health, education, government agencies and services, financial services, energy, consumer retail, information technology, food and agriculture, consumer services, commercial facilities, non-government organizations, chemicals, critical manufacturing, and transportation. This wide-ranging victimology suggests the actor is opportunistic rather than focused on specific verticals, consistent with the affiliate model where targets are selected based on access availability and potential financial return rather than strategic intelligence objectives.

Historical Context

Microsoft Threat Intelligence has tracked Storm-2570 since April 2025 across multiple investigated intrusions. The actor's timeline shows deployment of Qilin, DragonForce, Anubis, and BERT ransomware payloads, demonstrating a pattern of shifting between different RaaS operations. Throughout these campaigns, Storm-2570 has maintained largely uniform tradecraft, infrastructure overlaps, and repeated use of the same remote access and cloud exfiltration tooling despite the changing ransomware payloads. This consistency in behavior across multiple ransomware ecosystems distinguishes Storm-2570 from actors that remain loyal to a single RaaS operation and illustrates how tracking ransomware by payload alone can obscure the affiliates carrying out intrusions and their recurring behaviors.

Defensive Recommendations

  • Monitor for deployment of multiple RMM tools (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM, Remotely_Agent) especially when renamed with organization-specific names or deployed outside normal IT management processes
  • Detect Base64-encoded command execution associated with legitimate remote management binaries, particularly meshagent64.exe variants with custom naming conventions
  • Alert on ntdsutil.exe execution for credential dumping activity, especially when preceded by RMM tool deployment and followed by lateral movement tools like PsExec, Impacket, or NetExec
  • Monitor for cloud exfiltration tools s5cmd and Rclone, particularly large data transfers to external cloud storage services during off-hours or from unusual accounts
  • Implement behavioral detection for attack chain progression: RMM tool deployment → credential access → network scanning (NetScan, Nmap) → lateral movement → security product tampering, as this sequence is consistent across Storm-2570 intrusions regardless of final ransomware payload