Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Microsoft Threat Intelligence documents the activities of Storm-2570, a cross-ecosystem ransomware affiliate observed since April 2025 deploying multiple ransomware families (Qilin, DragonForce, Anubis, BERT). The report highlights consistent post-compromise tradecraft—frequent use of RMM tools (notably MeshAgent), tunneling (Cloudflared, ngrok), credential theft (Mimikatz, NTDS.dit dumps), lateral movement (PsExec, Impacket), and cloud-based exfiltration (s5cmd, Rclone)—across incidents affecting diverse sectors and countries, and provides detection guidance, hunting queries, and mitigation recommendations to disrupt intrusions before ransomware deployment.