[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjyZxPBH4OxWADsbTyp3MLObrHkdlwv9D9pTVdqnjSOA":3},{"article":4,"iocs":46,"watch_terms":56,"solutions":57,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"3b82b54d-850d-49b0-bd97-7b561842cec3","Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments","beyond-the-ransomware-tracking-storm-2570-s-consistent-tradecraft-across-deploym-c7a3d4","Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment. The post Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments appeared first on Microsoft Security Blog.","Storm-2570, a ransomware affiliate tracked since April 2025, demonstrates consistent post-compromise tradecraft across multiple ransomware-as-a-service (RaaS) ecosystems, including Qilin, DragonForce, Anubis, and BERT. This affiliate operates across various industries and geographies, shifting between ransomware operations to maximize payouts. Microsoft highlights the importance of tracking actor behavior rather than just payloads to detect and disrupt these recurring intrusions.","Storm-2570 ransomware affiliate uses consistent post-compromise tools across Qilin, DragonForce, Anubis, and BERT","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F09\u002F24\u002Fbeyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FFig1-Storm-2570-social-1.png","2026-09-24T16:00:00+00:00","2026-09-24T20:00:11.336927+00:00",8,[17,20],{"name":18,"type":19},"Storm-2570","threat_actor",{"name":21,"type":22},"Microsoft","vendor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,52,54],{"type":40,"value":48,"context":49},"Qilin","Ransomware family used by Storm-2570",{"type":40,"value":51,"context":49},"DragonForce",{"type":40,"value":53,"context":49},"Anubis",{"type":40,"value":55,"context":49},"BERT",[21],{"controls":58,"vendors":145},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":110,"vendor_name":21,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":117,"name":118,"problem":119,"products":120},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[146],{"slug":110,"name":21,"logo_path":111,"roles":147},[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":164},"raas-affiliate-storm-2570-highlights-danger-of-payload-focused-detection","RaaS Affiliate Storm-2570 Highlights Danger of Payload-Focused Detection","Storm-2570 demonstrates that modern ransomware threat actors are not tightly coupled to a single ransomware strain — they fluidly shift between RaaS platforms like Qilin, DragonForce, Anubis, and BERT while maintaining consistent post-compromise behaviors. Organizations that rely solely on signature- or payload-based detection will repeatedly miss the same attacker because the malware changes but the tradecraft does not. This matters because the affiliate model decouples the criminal infrastructure from the attack execution, making attribution and disruption far harder. Defenders must pivot to behavioral detection — focusing on attacker TTPs such as lateral movement patterns, credential harvesting techniques, and persistence mechanisms — rather than waiting to recognize a specific ransomware binary.",[154,155,156,157,158,159,160,161,162,163],"MITRE ATT&CK: TA0008 (Lateral Movement), TA0006 (Credential Access), TA0040 (Impact)","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","NIST SP 800-61: Computer Security Incident Handling Guide","NIST SP 800-137: Information Security Continuous Monitoring","NIST CSF DE.CM-1: Network Monitoring","NIST CSF RS.AN-1: Notifications from Detection Systems Investigated","NIST AC-6: Least Privilege","ITIL: Problem Management (recurring threat actor patterns)",{"NIST AC-6: Least Privilege":165,"CIS Control 8: Audit Log Management":166,"NIST CSF DE.CM-1: Network Monitoring":167,"CIS Control 17: Incident Response Management":168,"CIS Control 13: Network Monitoring and Defense":169,"NIST SP 800-61: Computer Security Incident Handling Guide":170,"ITIL: Problem Management (recurring threat actor patterns)":171,"NIST SP 800-137: Information Security Continuous Monitoring":172,"NIST CSF RS.AN-1: Notifications from Detection Systems Investigated":173,"MITRE ATT&CK: TA0008 (Lateral Movement), TA0006 (Credential Access), TA0040 (Impact)":174},"Least privilege limits the credential access and lateral movement that Storm-2570 relies on before deploying ransomware.","Collecting and reviewing logs gives the evidence needed to spot consistent post-compromise behaviour, rather than relying on payload signatures.","Network monitoring detects activity like lateral movement that remains consistent across Storm-2570's campaigns.","Incident response planning should focus on behaviours common to Storm-2570's intrusions so teams act before encryption.","Network monitoring detects lateral movement and staging that precede ransomware, whichever RaaS platform is used.","Incident handling guidance helps teams investigate behaviour patterns, which matter more than the specific ransomware payload.","Problem management can identify recurring attacker patterns and drive lasting fixes rather than reacting to each new payload.","Continuous monitoring provides ongoing visibility of attacker behaviour, catching affiliates who change malware but not tactics.","Investigating alerts thoroughly helps teams spot an intrusion pattern even when the malware itself is new.","Mapping Storm-2570's lateral movement, credential access and impact behaviours lets defenders detect the actor regardless of which ransomware strain it deploys."]