# Microsoft Tracks Storm-2570 Ransomware Affiliate Behind Qilin, DragonForce, Anubis, and BERT Deployments

> Microsoft Threat Intelligence has tracked Storm-2570, a cross-ecosystem ransomware affiliate, since April 2025 as it rotates between Qilin, DragonForce, Anubis, and BERT ransomware payloads while reusing an identical pre-encryption tradecraft chain. The actor has hit healthcare, education, government, financial, energy, and manufacturing organizations across the US, Canada, UK, Spain, Netherlands, and Puerto Rico, and Microsoft's guidance emphasizes detecting the shared toolchain rather than any single ransomware family.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2729
- **ID:** TL-2026-2729
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Storm-2570
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Storm-2570 is a ransomware affiliate that Microsoft Threat Intelligence has followed since April 2025 across intrusions ultimately culminating in four different ransomware payloads: Qilin, DragonForce, Anubis, and BERT. Rather than being tied to a single ransomware-as-a-service (RaaS) brand, Storm-2570 behaves as a cross-ecosystem operator that shifts between RaaS programs as opportunities arise, retaining the flexibility to deploy whichever payload is most advantageous for a given payout while keeping its intrusion tradecraft essentially constant.

Microsoft states that the actor's initial access method remains unconfirmed, but from the point of foothold onward the group follows a highly consistent playbook. Discovery is performed with NetScan, SoftPerfect Network Scanner Portable, Nmap, and native Windows commands to map reachable hosts, shares, and high-value targets. Credential access relies on Mimikatz, LaZagne, and pypykatz for in-memory credential theft, paired with ntdsutil.exe to create an Install-From-Media (IFM) backup of the Active Directory database (NTDS.dit) staged under C:\Windows\Temp.

For persistence and hands-on-keyboard access, Storm-2570 deploys a wide bench of legitimate remote monitoring and management (RMM) tools -- MeshAgent/MeshCentral (its most consistent tool, frequently renamed to match the victim organization, e.g. meshagent64-[organization].exe), Atera, ScreenConnect, NinjaRMM, Splashtop, and Remotely_Agent -- alongside Cloudflare Tunnel (cloudflared.exe, run as a persistent LocalSystem service) and ngrok to expose RDP on TCP 3389. Defense evasion centers on tampering with Microsoft Defender: disabling real-time monitoring, adding an exclusion for C:\PerfLogs, and modifying DisableAntiSpyware/DisableRealtimeMonitoring registry values and WinDefend service behavior. Lateral movement is carried out with PsExec (driven by host lists such as @ip.txt), Impacket, and NetExec over SMB, plus batch scripts (rdp.bat) that enable Remote Desktop and open the corresponding firewall rule.

Before encryption, the group exfiltrates data using s5cmd (staged with hardcoded AWS access keys to push documents, spreadsheets, databases, mail files, images, and archives to attacker-controlled S3 buckets) and Rclone for real-time cloud synchronization, supporting a double-extortion model. Only after staging is complete does Storm-2570 hand off to whichever ransomware payload -- Qilin, DragonForce, Anubis, or BERT -- is deployed for that engagement, each of which independently operates a RaaS/cartel affiliate program (Qilin: 80-85% affiliate payouts plus a 'Call Lawyer' pressure feature and a Tor/clearnet WikiLeaksV2 leak site; DragonForce: a self-declared 'cartel' since March 2025 offering white-label branding and 80% payouts to affiliates). Microsoft's guidance to defenders is to hunt the consistent pre-encryption toolchain -- rogue RMM agents, NTDS.dit IFM extraction, Defender tampering, PsExec-driven lateral movement, and S3/Rclone exfiltration -- rather than waiting to catch the final, rotating ransomware family.

## MITRE ATT&CK

- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1033 System Owner/User Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1003.001 LSASS Memory
- T1003.003 NTDS
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1059.001 PowerShell
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1537 Transfer Data to Cloud Account
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Beyond the ransomware: Tracking Storm-2570's consistent tradecraft across deployments](https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/)
- [Microsoft Finds Ransomware Group Behind Multiple High-Profile Attacks](https://cybersecuritynews.com/microsoft-finds-ransomware-group/)
- [Microsoft Tracks Storm-2570 Ransomware Affiliate Behind Qilin, DragonForce and Anubis Attacks](https://cyberpress.org/storm-2570-linked-to-ransomware/)
- [Beyond the ransomware: Tracking Storm-2570's consistent tradecraft across deployments (mirror)](https://thewindowsupdate.com/2026/09/24/beyond-the-ransomware-tracking-storm-2570s-consistent-tradecraft-across-deployments/)
- [DragonForce Ransomware Cartel vs. Everybody](https://blog.barracuda.com/2025/06/09/dragonforce-ransomware-cartel-vs--everybody)
- [Qilin And INC Ransom Drive 2026 Ransomware Surge](https://thecyberexpress.com/qilin-inc-ransom-drive-2026-ransomware-surge/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2729