The ransomware changes. The intruder does not. Microsoft Threat Intelligence says a single ransomware affiliate, which it tracks as Storm-2570, has deployed four different ransomware families in its intrusions (Qilin, DragonForce, Anubis and BERT) while using largely the same remote access, credential theft and data exfiltration tools every time.
That matters because many organizations still sort ransomware attacks by the payload that encrypted their files. In its report, Microsoft argues that the payload is the least useful thing to track, because an affiliate like Storm-2570 moves between ransomware programs as opportunities arise and brings its habits along.
A freelancer working for several gangs
Microsoft has tracked Storm-2570 since April 2025. In ransomware as a service, the brand owners write the encryptor and run the leak site, while affiliates break into networks and deploy it for a cut of the ransom. Storm-2570 appears to work for at least four of those programs, including Qilin and DragonForce, two of the most active crews of the past year.
Microsoft has seen the actor in intrusions in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico. The victims span healthcare, education, government services, financial services, energy, retail, IT, food and agriculture, manufacturing, chemicals, transportation and non-profits. How Storm-2570 gets its initial foothold remains unconfirmed.
The same tools, whatever the ransom note says
Once inside, Storm-2570 leans heavily on legitimate remote management software. Microsoft lists Atera, MeshAgent, ScreenConnect, Splashtop, Remotely_Agent and NinjaRMM, often several in one intrusion. MeshAgent stands out: the actor renames its binaries after the victim organization, in the form meshagent64-[organization name].exe, likely so the tool looks like it belongs. It pairs these tools with ngrok and Cloudflare Tunnel to keep an outbound channel open, in one case registering the tunnel as a service running as LocalSystem.
For credential theft Microsoft observed Mimikatz, LaZagne and pypykatz, plus the built-in ntdsutil utility used to copy the Active Directory database from a domain controller, which signals the actor already holds high privileges. It then weakens Microsoft Defender by disabling real-time monitoring and adding exclusions, including for C:\PerfLogs, before spreading with PsExec, Impacket, NetExec and RDP scripts. Data leaves through Rclone or, most often, s5cmd, a command-line tool for copying files to Amazon S3 compatible storage, which the actor points at buckets it controls before any encryption starts.
None of this is new tradecraft, and Microsoft says so. The point is that it is consistent, and consistency is what defenders can detect.
Turn on tamper protection and hunt for unapproved RMM tools
Microsoft's guidance focuses on the stages before ransomware runs:
- Enable tenant-wide tamper protection so attackers cannot switch off Defender or add exclusions, and consider DisableLocalAdminMerge to stop exclusions being pushed through Group Policy.
- Enforce MFA on approved RMM platforms. If an unapproved RMM install turns up, reset the passwords of the accounts used to install it, and investigate further if a System-level account was used.
- Turn on attack surface reduction rules that block credential theft from LSASS, obfuscated scripts, and process creation from PsExec and WMI.
- Configure automatic attack disruption in Defender XDR.
Good hunting leads from the report include RMM binaries named after your own company, new Cloudflare Tunnel services, ntdsutil creating installation media copies in C:\Windows\Temp, and s5cmd.exe sitting next to a credentials file. We have covered a similar pattern before, when an access broker used a Citrix bug to plant DragonForce.
The lesson is simple enough to fit on a sticky note: the brand on the ransom note tells you who gets paid, but the tools on the network tell you who is actually there, and only the second one arrives in time to stop the encryption.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.