Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
Microsoft says affiliate Storm-2570 reused one playbook across Qilin, DragonForce, Anubis, and BERT.
74
Country
Puerto Rico
- Mentions · 7d0
- Mentions · 30d0
- All mentions9
- First seenSep 17, 2026
- Last mentionedSep 25, 2026
Timeline
9 articles · newest firstBeyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
70
China's Salt Typhoon backdoors Latin American orgs with new snooping malware
China-linked Salt Typhoon deployed new modular backdoor SparroWocky against Latin American government agencies since August 2025.
76
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
78
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
78
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.
78
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
China-aligned espionage group FamousSparrow replaced SparrowDoor with a new modular backdoor, SparroWocky, targeting government entities across eight Latin American countries since August 2025.
74
Chinese hackers use SparroWocky malware in govt espionage attacks
ESET reports China-linked FamousSparrow deployed a new modular backdoor, SparroWocky, in year-long espionage attacks on Latin American government organizations.
70
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET attributes a new modular C++ backdoor, SparroWocky, to China-aligned group FamousSparrow, deployed against government entities across Latin America since August 2025.
75
Related CVEs
by mentions- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
Appears with
- SparroWockymalware · 7
- ESETvendor · 7
- FamousSparrowthreat actor · 7
- SparrowDoormalware · 5
- Salt Typhoonthreat actor · 3
- ESETorganization · 3
- Earth Estriesthreat actor · 3
- BERTmalware · 2
- Anubismalware · 2
- DragonForcemalware · 2
- Storm-2570threat actor · 2
- Mbed TLSproduct · 2
- Microsoftvendor · 2
- Trend Microvendor · 2
- Qilinmalware · 2
- SparrowDoorproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.