Microsoft Finds Ransomware Group Using Same Attack Blueprint Across Multiple Malware Families

Microsoft has linked a ransomware affiliate to attacks that ended with four different ransomware families. The group, tracked as Storm-2570, repeatedly used the same methods to take control of networks, steal data and prepare systems for encryption.

The changing ransomware name often concealed a familiar operator. Storm-2570 has been tracked since April 2025. Its intrusions have affected organizations in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico, across sectors ranging from healthcare and education to energy and manufacturing.

Microsoft has not established how the group first enters victim networks. Analysts from Microsoft identified a consistent pattern after access was gained, even when attacks ended with Qilin, DragonForce, Anubis or BERT ransomware.

The overlap matters because investigators can spot the same attacker before the final malware arrives, rather than waiting for an encryption alert.

Microsoft said in a report shared with Cyber Security News (CSN) that Storm-2570 appears to work across several ransomware services instead of staying with one operation.

That flexibility helps explain why related intrusions can look different at the end. Previous reporting on DragonForce and Anubis affiliate models offers context for how those criminal partnerships operate.

Microsoft Finds Ransomware Group Using Same Attack Blueprint

Once inside, the attackers install remote management software that lets them issue commands and maintain access. MeshAgent appears repeatedly, sometimes with MeshCentral, while other cases involve Atera, NinjaRMM, ScreenConnect, Splashtop or Remotely_Agent.

Operators may rename a MeshAgent program to resemble a file associated with the victim organization.

They also use tunneling tools to preserve a route back into the network. In one case, a Cloudflare Tunnel ran automatically with high privileges, creating an encrypted outbound connection.

Elsewhere, ngrok helped expose remote desktop access. These actions can make attacker activity blend with ordinary remote administration.

Next comes a search for useful systems, accounts and files. Storm-2570 uses network scanners, then tools such as Mimikatz, LaZagne and pypykatz to obtain credentials.

Investigators also saw the group use a built-in Windows utility to copy Active Directory data, which could expose passwords across a victim’s domain.

The group then weakens security controls and spreads to additional machines. Microsoft observed disabled real-time protection, antivirus exclusions and registry changes, followed by remote execution through PsExec, Impacket, NetExec or remote desktop scripts.

Similar misuse of MeshAgent in another recent ransomware investigation shows why an unexpected management agent deserves attention, though that case concerns a different operation.

Data Theft and Early Defense

Before deploying ransomware, Storm-2570 often moves valuable files to attacker-controlled cloud storage. It uses s5cmd to copy selected documents, spreadsheets, databases and archives into S3 buckets, while Rclone can synchronize files over time.

The result is a second source of pressure on victims: stolen information may remain exposed even if encrypted systems are restored.

Microsoft did not give a total victim count or an estimate of financial losses. It also did not say how many investigated intrusions progressed from data theft to full ransomware deployment.

The same mix of scanning, remote access and cloud uploads has appeared in research on ransomware affiliate overlap. That does not prove every similar incident involves Storm-2570.

It does show why responders should connect events across an entire intrusion instead of identifying the attacker solely by the ransomware note.

Microsoft recommends limiting account privileges, strengthening credential practices and protecting security settings against tampering.

Organizations should require multifactor authentication for approved remote management tools, investigate unapproved installations and reset the credentials of accounts used to install them.

Teams should also watch for unusual cloud transfers and attempts to open remote desktop access. Detection before encryption is the practical goal.

Unexpected remote tools, credential dumping, changes to antivirus settings and rapid transfers to cloud storage form a clearer warning when viewed together.

Reporting on Qilin attacks using RDP history gives another example of how remote access traces can reveal an attacker’s movement before the final payload runs.

These signals can remain useful across ransomware families because an operator’s habits often survive a change in criminal branding.

IIndicators of compromise (IoCs):-

Type	Indicator	Description
File name pattern	meshagent64-[organization name].exe	Example of a MeshAgent executable renamed to include the victim organization’s name. The bracketed text is a placeholder, not a literal filename.
File name	Cloudflared.exe	Tunneling utility used to maintain outbound remote access.
File name	ntdsutil.exe	Windows utility used to create an Active Directory backup during credential theft. Its presence alone is not proof of compromise.
File name	NTDS.dit	Active Directory database material targeted for credential extraction.
File name	ip.txt	Example host list referenced as @ip.txt in PsExec commands.
File name	rdp.bat	Script observed enabling Remote Desktop access on additional systems.
File name	s5cmd.exe	Cloud-transfer utility staged for data exfiltration. Its presence alone is not proof of compromise.
File path	C:\PerfLogs	Directory added to antivirus exclusions in observed intrusions.
File path pattern	C:\Windows\Temp\<XXXXXXXXX>	Example backup location in the source; the final component is a placeholder.
Hunting-query file names	psexec.exe, psexec64.exe	Executable names in Microsoft’s hunt for remote execution; neither is inherently malicious.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC