Storm-2570 keeps its methods while changing ransomware payloads

Microsoft reported on 24 September that it observed Storm-2570 activity across deployments involving Qilin, DragonForce, Anubis and BERT ransomware. The company describes the tracked group as an affiliate whose post-compromise methods remained broadly consistent despite those changes.

The investigation follows recurring remote access, credential use, lateral movement, security tampering and data transfer. Looking only at the final ransomware family can separate incidents that share important operational behaviour. Conversely, use of the same encryptor does not establish that the same affiliate carried out every intrusion. Microsoft’s report uses the surrounding evidence to connect activity and identifies opportunities to interrupt it before encryption.