Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Microsoft Threat Intelligence published research on September 24, 2026 on Storm-2570, a ransomware affiliate tracked since April 2025 that operates across multiple ransomware-as-a-service ecosystems rather than supporting one family. Microsoft has observed the same tradecraft, infrastructure overlaps, and tooling in intrusions ending in Qilin, DragonForce, Anubis, and BERT ransomware. Investigated incidents span the US, Canada, UK, Spain, Netherlands, and Puerto Rico across healthcare, education, government, financial services, energy, retail, IT, food and agriculture, NGOs, chemicals, critical manufacturing, and transportation.

The core finding is payload-agnostic behavior. Initial access remains unconfirmed, but post-compromise activity is consistent: commodity RMM tools (Atera, MeshAgent, ScreenConnect, Splashtop, Remotely_Agent, NinjaRMM), discovery and lateral movement tooling (NetScan, Nmap, PsExec, Impacket, NetExec, RDP batch scripts), and collection and exfiltration via s5cmd and Rclone. MeshAgent is the most frequent bridge between hands-on-keyboard access and later stages; Storm-2570 renames meshagent64 binaries with victim-themed names such as meshagent64-[organization name].exe and Base64-encodes commands to blend in. One documented chain paired MeshAgent with NinjaRMM before ntdsutil credential dumping, network scanning, and Qilin deployment. The actor also uses ngrok and Cloudflared.exe to expose RDP or hold persistent outbound tunnels, and often runs several access tools in the same intrusion.

The defender takeaway from the report is to detect the affiliate before the payload: RMM agent installs on servers, renamed remote-management services, ntdsutil use, and Rclone or s5cmd egress are pre-ransom signals that hold regardless of which family finally lands. Watch for additional RaaS ecosystems adding Storm-2570 to their affiliate rosters and for incident reports matching this tooling pattern under ransomware names other than the four documented here.