Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
Microsoft says affiliate Storm-2570 reused one playbook across Qilin, DragonForce, Anubis, and BERT.
74
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 24, 2026
- Last mentionedSep 25, 2026
Timeline
2 articles · newest firstBeyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
70
Appears with
- Storm-2570threat actor · 2
- DragonForcemalware · 2
- Qilinmalware · 2
- Anubismalware · 2
- government agenciesorganization · 1
- financial servicesorganization · 1
- healthcarevictim · 1
- ransomware affiliateproduct · 1
- commercial facilitiesvictim · 1
- ngrokproduct · 1
- energyorganization · 1
- financial servicesvictim · 1
- consumer retailorganization · 1
- consumer retailvictim · 1
- RaaSproduct · 1
- MeshAgentproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.