Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families
Microsoft says affiliate Storm-2570 reused one playbook across Qilin, DragonForce, Anubis, and BERT.
Microsoft linked ransomware affiliate Storm-2570, tracked since April 2025, to intrusions that ended with Qilin, DragonForce, Anubis, or BERT ransomware. Affected organizations span the United States, Canada, the United Kingdom, Spain, the Netherlands, and Puerto Rico, including healthcare, education, energy, and manufacturing. After access, the group installs remote-management tools such as MeshAgent, tunnels with Cloudflare Tunnel or ngrok, dumps credentials with Mimikatz, LaZagne, pypykatz, and ntdsutil, disables antivirus, and moves laterally with PsExec, Impacket, or NetExec. Before encryption it exfiltrates documents and databases to cloud storage using s5cmd and Rclone. Microsoft did not disclose initial access, victim counts, or losses.
- Storm-2570 has reused the same post-access playbook since April 2025.
- Final payloads included Qilin, DragonForce, Anubis, and BERT ransomware.
- Operators abused RMM tools, tunnels, and dumpers including Mimikatz.
- Files were copied to cloud storage with s5cmd and Rclone before encryption.
- Microsoft did not disclose initial access, victim totals, or losses.
- ATT&CK
- T1219 Remote Access SoftwareT1003 OS Credential DumpingT1562.001 Disable or Modify ToolsT1567.002 Exfiltration to Cloud StorageT1486 Data Encrypted for Impact
- Vendors
- Microsoft
- Products
- MeshAgentCloudflare Tunnelngrok
- Threat actors
- Storm-2570
- Malware
- QilinDragonForceAnubisBERT
- Organizations
- Microsoft
From the original article
4 min read at cybersecuritynews.com
Microsoft has linked a ransomware affiliate to attacks that ended with four different ransomware families. The group, tracked as Storm-2570, repeatedly used the same methods to take control of networks, steal data and prepare systems for encryption. The changing ransomware name often concealed a familiar operator.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.