Threat Intelligence

Same Attacker, Different Ransomware: Why Tracking Storm-2570 by Behaviour Matters

Microsoft Security · 25 Sept 2026

Key Takeaway Focus your monitoring on attacker behaviours such as unexpected remote access tools, credential theft, security software tampering and large data uploads to cloud storage, because these warning signs appear before any ransomware payload runs.

Microsoft Threat Intelligence has been tracking a ransomware affiliate called Storm-2570 since April 2025. The group has worked across several ransomware-as-a-service ecosystems, including Qilin, DragonForce, Anubis and BERT. Despite switching payloads, Storm-2570 has kept largely uniform tradecraft, overlapping infrastructure, and repeated use of the same remote access and cloud data exfiltration tools.

Microsoft's key point is that tracking ransomware by payload alone can hide who is actually carrying out the intrusion. Recurring activity across the attack chain, including remote access, credential access, lateral movement, security tampering and data theft, can help defenders link related incidents. That in turn creates a chance to respond before ransomware is deployed, even when the final payload changes.

Microsoft has seen Storm-2570 in multiple investigated intrusions affecting organisations in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico. Targeted sectors include healthcare, education, government, financial services, energy, retail, IT, food and agriculture, manufacturing, transportation and non-government organisations. Microsoft notes that the group's methods align with those of many other ransomware actors, which means the lessons on hardening and detection apply broadly, including after an attacker has already gained initial access to a network.

ransomware Storm-2570 threat intelligence ransomware-as-a-service detection

Summarised by CISO AI from Microsoft Security, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.