Microsoft Storm-2570: Hunt the Tradecraft Behind Qilin, DragonForce, Anubis and BERT

By AiCybr Editorial · Published September 26, 2026

Microsoft Threat Intelligence published a defender-focused profile of Storm-2570 on September 24, 2026, documenting a ransomware affiliate that has reused substantially consistent post-compromise tradecraft across intrusions ending in Qilin, DragonForce, Anubis and BERT ransomware. Microsoft has tracked the affiliate since April 2025 and has investigated activity affecting organizations across the United States, Canada, United Kingdom, Spain, Netherlands and Puerto Rico.

The recurring signals appear before encryption. Microsoft observed remote-management tools including Atera, MeshAgent, ScreenConnect, Splashtop, Remotely_Agent and NinjaRMM; discovery and lateral-movement tooling including NetScan, Nmap, PsExec, Impacket and NetExec; credential-access activity involving Mimikatz, LaZagne, pypykatz and NTDS.dit; and data movement through s5cmd and Rclone. Microsoft says the actor's initial-access method remains unconfirmed.

For defenders, the practical value is a hunt model that follows the affiliate's recurring behavior across ransomware brands. Unexpected RMM installation, privileged credential access, security-control tampering, lateral execution and cloud-transfer activity can provide detection opportunities before the final ransomware payload runs.

Storm-2570's recurring attack chain

Microsoft's investigations show a broadly repeatable sequence after the initial foothold:

These are dual-use tools in many environments. The strongest detections combine unexpected tool presence with account, host, timing and sequence context instead of treating a legitimate administrative binary alone as proof of compromise.

MeshAgent and multiple RMM tools are useful pivots

Microsoft identifies MeshAgent as one of Storm-2570's most frequently observed remote-access and execution tools. In investigated intrusions, the affiliate sometimes renamed MeshAgent binaries or services using victim-themed names and used it alongside other RMM software.

The actor also rotates among Atera, ScreenConnect, Splashtop, Remotely_Agent and NinjaRMM. That creates a practical inventory question: which remote-management products are authorized in the environment, where should their agents exist, and which identities normally install or operate them?

A useful hunt therefore starts with newly installed or renamed RMM services and correlates them with subsequent discovery, privileged account use, Defender tampering, remote execution or large outbound transfers. Multiple unrelated RMM products appearing on the same host or in the same incident window deserve additional scrutiny.

Credential access and lateral movement raise the priority

Microsoft observed Storm-2570 using Mimikatz, LaZagne and pypykatz for credential access. The affiliate has also used ntdsutil in activity consistent with staging Active Directory database material for offline credential extraction.

On the lateral-movement side, Microsoft repeatedly observed PsExec and also documented Impacket, NetExec, RDP scripts and administrative shares. A high-confidence investigation path is to correlate credential-access alerts with subsequent remote execution from the same identity or host, especially when the destination set expands rapidly across servers or workstations.

Microsoft Defender for Endpoint includes detections for exposed or compromised credentials, suspicious remote execution and ransomware-related behavior. Microsoft also recommends an attack-surface-reduction rule that blocks process creation originating from PsExec and WMI where operational compatibility allows it.

Watch for Defender tampering before ransomware deployment

Microsoft reports repeated attempts to weaken endpoint protection before impact. Observed activity includes disabling real-time monitoring, adding Microsoft Defender exclusions and modifying Defender-related registry or service settings.

Defender tamper protection is therefore a key control in Microsoft's guidance. Security teams should also alert on exclusion changes and protection-setting modifications performed by identities or processes outside approved endpoint-management workflows.

A sequence such as new RMM agent → credential access → Defender exclusion or service change → PsExec/SMB lateral movement is more decision-useful than any single event in isolation.

s5cmd and Rclone can expose the exfiltration phase

Storm-2570 has used both s5cmd and Rclone for data theft. Microsoft says s5cmd is the more common of the two in its investigated activity, with the actor staging the utility and credentials before transferring selected business data to attacker-controlled object storage.

Organizations that legitimately use these tools can baseline approved hosts, identities, destinations and deployment paths. Unexpected first execution on a server, a newly created cloud credential file, or bulk transfers following discovery and credential-access events should receive elevated priority.

This phase matters because Microsoft's observed chain can include data theft before ransomware deployment. Detecting the affiliate during collection or exfiltration can therefore limit both confidentiality loss and later encryption impact.

Microsoft-recommended controls

Microsoft's September 24 guidance prioritizes several controls that map directly to the observed chain:

1. Enable tenant-wide tamper protection to make security-service and antivirus-exclusion changes harder for an attacker.
2. Configure automatic attack disruption in Microsoft Defender XDR where licensed and operationally appropriate.
3. Deploy relevant attack-surface-reduction rules, including controls for LSASS credential theft, obfuscated scripts and PsExec/WMI-originated process creation after compatibility testing.
4. Apply credential hygiene and least privilege to reduce the value of harvested accounts and constrain lateral movement.
5. Inventory legitimate RMM and cloud-transfer software so detections can distinguish approved administration from unexpected deployment.
6. Correlate behavior across phases: RMM deployment, discovery, credential access, protection tampering, lateral movement and exfiltration provide a stronger signal together.

Microsoft publishes corresponding Defender detections and threat-hunting queries in its technical report. Defender XDR customers can also access Storm-2570 and ransomware-family threat-analytics reports in the Defender portal, subject to product licensing.

Scope and attribution

Microsoft assesses Storm-2570 as a ransomware affiliate operating across multiple ransomware-as-a-service ecosystems. The company has observed related intrusions in healthcare and public health, education, government, financial services, energy, retail, IT, agriculture, commercial facilities, NGOs, chemicals, critical manufacturing and transportation.

The report leaves initial access unconfirmed. Defender response should therefore focus on the post-compromise behaviors Microsoft has repeatedly observed instead of assuming one entry vector. The named RMM, scanning and transfer tools also have legitimate administrative uses; environment-specific baselines and event correlation are central to reliable triage.

Bottom line

Storm-2570 gives defenders a useful example of why affiliate-level behavior can remain stable while the ransomware payload changes. Microsoft's investigations connect four ransomware families to a recurring operational chain built around commercial RMM software, credential access, Defender tampering, lateral execution and cloud exfiltration.

The immediate action is to inventory those tools and convert the recurring sequence into correlated detections. Environments using Microsoft Defender can additionally apply the vendor's published tamper-protection, attack-disruption and attack-surface-reduction guidance, then use the report's hunting queries to review relevant telemetry.

Sources

• Microsoft Threat Intelligence — Storm-2570 technical research, September 24, 2026: https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
• Microsoft Learn — Microsoft Defender XDR automatic attack disruption: https://learn.microsoft.com/en-us/defender-xdr/automatic-attack-disruption
• Microsoft Learn — attack surface reduction rules reference: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference
• Independent current corroboration — CyberPress, September 25, 2026: https://cyberpress.org/storm-2570-linked-to-ransomware/