Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments.
Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate linked to multiple ransomware payloads, using consistent tradecraft across deployments across multiple ransomware ecosystems.
- Storm-2570 is a ransomware affiliate linked to multiple ransomware payloads
- It uses consistent post-compromise tradecraft across deployments
- It operates across multiple ransomware ecosystems and ransomware as a service (RaaS)
- Threat actors
- Storm-2570
- Malware
- QilinDragonForceAnubisBERT
- Victims
- healthcarepublic healthgovernment agenciesfinancial servicesenergyconsumer retailinformation technology (IT)food and agricultureconsumer servicescommercial facilities
- Organizations
- healthcarepublic healthgovernment agenciesfinancial servicesenergyconsumer retailinformation technology (IT)food and agricultureconsumer servicescommercial facilities
- AI models
- Storm-2570
From the original article
12 min read at microsoft.com
Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment. The post Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments appeared first on Microsoft Security Blog.
By Microsoft Threat Intelligence · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.