Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

1. Executive summary

Microsoft Threat Intelligence has published a tradecraft analysis of Storm-2570, a ransomware affiliate it has tracked since April 2025 that operates across the Qilin, DragonForce, Anubis and BERT ransomware-as-a-service ecosystems. Microsoft reports investigated intrusions against organisations in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico, with financial services named among the targeted sectors. No CVE, CVSS score or CISA KEV entry applies to this item: the report describes actor behaviour, not a vulnerability, and Microsoft states the initial access method is unconfirmed. The exposure for EMEA financial services is that the same remote access, credential access, lateral movement and cloud exfiltration pattern recurs regardless of which ransomware payload is deployed, so detection tuned to a single ransomware family will miss the intrusion before encryption. This reporting is single-sourced to Microsoft; no second vendor or national CERT has corroborated the tooling set or the sector targeting.

2. Regulatory framing

3. Technical analysis & attack chain

Microsoft's account of the intrusion chain, in the order the source describes it:

1. Initial access. Method unconfirmed. Microsoft states only that observed chains begin with remote management tooling and hands-on-keyboard activity after a foothold exists.
2. Remote access establishment. MeshAgent with MeshCentral is the most frequently observed tool, deployed alongside Atera, ScreenConnect, Splashtop Streamer, Remotely_Agent and, in at least one intrusion, NinjaRMM.
3. Tunnelling. ngrok and Cloudflared.exe expose RDP or create persistent outbound tunnels. In one intrusion a Cloudflare Tunnel service was created on the victim host and configured to start automatically under LocalSystem.
4. Discovery. NetScan, SoftPerfect Network Scanner Portable and Nmap, plus native Windows discovery commands and file searching, to map reachable hosts, shares and files.
5. Credential access. Mimikatz, LaZagne and pypykatz, plus ntdsutil used to create an Install From Media copy of the Active Directory database.
6. Defence evasion. Microsoft Defender tampering: real-time monitoring disabled, an exclusion added for C:\PerfLogs, and registry values under Microsoft Defender service keys modified.
7. Lateral movement. PsExec (frequently with host lists such as @ip.txt), Impacket and NetExec over SMB, RDP batch scripts, and admin shares.
8. Exfiltration. s5cmd to attacker-controlled S3 buckets, or Rclone for continuous synchronisation to cloud storage.
9. Impact. Deployment of Qilin, DragonForce, Anubis or BERT ransomware, after data has already been taken.

Remote access and persistence

MeshAgent is the constant. Microsoft describes it appearing at key points across intrusions rather than as a one-off utility, used as an operational bridge between initial hands-on-keyboard activity and later account manipulation, discovery, credential access, security tampering and ransomware deployment. The actor tailors the deployment to the victim: the meshagent64 binary is renamed to include the compromised organisation's name, in the form meshagent64-[organization name].exe, and commands executed through it are Base64-encoded. In one intrusion MeshAgent ran alongside NinjaRMM before the chain moved to ntdsutil, network scanning and Qilin deployment.

The actor rotates across commercially available platforms within a single intrusion rather than standardising on one. Atera installs agents and executes interactive commands; AteraAgent was used to download and install Splashtop Streamer, which provided the interactive remote control component. ScreenConnect was used for command execution and account or domain reconnaissance. Remotely_Agent was installed as a persistent remote management service. Cloudflared.exe and ngrok provided the outbound path, with the Cloudflare Tunnel service running as LocalSystem to survive reboots and bypass inbound firewall restrictions.

Credential access

Three credential harvesting tools are named: Mimikatz, LaZagne and pypykatz. The higher-impact technique is ntdsutil. Microsoft describes a consistent usage pattern matching an Install From Media copy of Active Directory database material: the legitimate ntdsutil.exe activates the NTDS Active Directory instance and creates a full IFM backup under C:\Windows\Temp\. The actor then copies NTDS.dit and supporting registry hive material off-host for offline extraction of domain password hashes. Microsoft states this indicates high-privilege access to a domain controller.

Defence evasion

Before ransomware deployment the actor tampers with Microsoft Defender. Microsoft observed real-time monitoring disabled, an exclusion added for C:\PerfLogs to weaken endpoint detections, and registry values under Microsoft Defender service keys modified. The registry changes altered DisableAntiSpyware, DisableRealtimeMonitoring and WinDefend service behaviour. Microsoft states this pattern is consistent across intrusions involving Qilin, DragonForce and Anubis.

Lateral movement

PsExec is the most consistent lateral movement and deployment tool. It is used with host lists such as @ip.txt to move across systems and install renamed MeshAgent binaries on newly compromised hosts. Impacket and NetExec are used over SMB for remote execution and for credential theft and reconnaissance against internal Windows hosts. Microsoft notes Defender for Endpoint has a dedicated attack surface reduction rule for Impacket lateral movement.

Where RDP is not permitted, the actor enables it. An rdp.bat script appeared alongside PsExec, including cases where PsExec ran rdp.bat across hosts using @ip.txt. The script enables inbound Remote Desktop by modifying Terminal Server settings and adding a firewall rule permitting TCP port 3389. ngrok is also used to expose TCP 3389, after which PsExec activity and security tampering follow.

Exfiltration

s5cmd is the primary exfiltration tool. The actor identifies high-value drives and network shares, stages s5cmd.exe alongside a credentials file holding AWS access keys, and runs copy (cp) operations with extension filters to move documents, spreadsheets, images, databases, mail-related files and archives to attacker-controlled S3 buckets. Rclone is used as an alternative, synchronising newly created or updated files to cloud storage in real time so exfiltration continues through all stages without further attacker interaction. Microsoft characterises the outcome as double extortion: data collected through cloud-transfer tooling first, ransomware deployed afterwards.

Caveats

The source references example command lines for PsExec, rdp.bat, the NetExec SMB command, the ntdsutil IFM command and the s5cmd exfiltration, but the command lines themselves are not present in the material available to us. We have not reconstructed them. Everything above is Microsoft's description of observed activity; no raw telemetry, file hashes or infrastructure indicators were published with the report. The tooling set is dual-use and widely deployed for legitimate administration, so presence of any single tool is not evidence of compromise. Microsoft's naming of Storm-2570 is its own tracking designation; the actor has no MITRE ATT&CK profile in our reference data and the attribution should be treated as unconfirmed.

4. Mitigation & containment

P1 (within 24 hours)

• Hunt endpoint and service telemetry for the named RMM components: meshagent64 binaries including any renamed to meshagent64-[organization name].exe, MeshCentral, AteraAgent, ScreenConnect, Splashtop Streamer, Remotely_Agent and NinjaRMM. Where a component is not sanctioned by IT, isolate the host, capture volatile data and remove the service.
• Check for a Cloudflare Tunnel service configured to start automatically under LocalSystem, and for ngrok processes or outbound tunnels. Block cloudflared.exe and ngrok execution where there is no business justification.
• Verify Defender health on all endpoints: real-time monitoring enabled, no exclusion for C:\PerfLogs, DisableAntiSpyware and DisableRealtimeMonitoring registry values unmodified, WinDefend service running. Re-enable and re-scan any host where these were changed.
• Search for ntdsutil IFM output directories under C:\Windows\Temp\ and for any copy of NTDS.dit or registry hives leaving a domain controller. If found, treat all domain credentials as compromised: reset krbtgt twice and rotate privileged accounts.
• Alert on PsExec execution with a host list file such as @ip.txt, and on rdp.bat or any script that adds a firewall rule for TCP 3389.

P2 (within 72 hours)

• Build an allowlist of sanctioned RMM platforms and block the rest at the EDR and at the perimeter. This is the single control that most disrupts the chain, because the actor depends on commodity RMM for persistence and command execution.
• Restrict outbound access to object storage endpoints that are not in use. Alert on s5cmd.exe and rclone.exe execution, and on an AWS credentials file staged in the same directory as either binary.
• Disable RDP where it is not required. Where it is required, restrict TCP 3389 to jump hosts and monitor for Terminal Server setting changes and new inbound 3389 firewall rules.
• Enable the Microsoft Defender for Endpoint attack surface reduction rule for Impacket lateral movement, which Microsoft names as the mitigation for that technique.
• Enforce SMB signing and review admin share exposure to reduce the NetExec and Impacket lateral movement path.

P3 (within 7 days)

• Review privileged access: tier domain admin accounts, remove standing domain admin rights from workstation logons, and check for service accounts with interactive logon rights.
• Rehearse the double-extortion path. The actor exfiltrates before encrypting, so containment decisions made at the encryption event are already too late for the data.
• Convert the behavioural indicators in section 5 into detection content and validate them against 30 days of retained telemetry.

5. Indicators of compromise

No atomic indicators of compromise are present in the source material. Microsoft published no hashes, domains, IP addresses or file paths for actor-controlled infrastructure. The indicators below are behavioural and are derived from Microsoft's description of observed activity.

All rows are single-sourced to Microsoft. Verify against your own telemetry before enforcing blocks on dual-use tooling.

6. Detection

The YARA rule below targets strings that appear in the actor's staged tooling and scripts. It is low fidelity on its own because several of the strings are dual-use tool names; use it to triage staged files and corroborate with the process and service telemetry in section 5.

rule AT_Storm2570_Staged_Tooling_Artefacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-24"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/"
        description = "Detects files carrying strings associated with Storm-2570 staged tooling, including the renamed MeshAgent binary pattern, the actor host list, the RDP enabling script and the C:\\PerfLogs Defender exclusion path. Low fidelity; corroborate with process and service telemetry."
        confidence = "low"
    strings:
        $mesh1 = "meshagent64-" ascii nocase
        $mesh2 = "meshcentral" ascii nocase
        $hostlist = "@ip.txt" ascii nocase
        $rdpbat = "rdp.bat" ascii nocase
        $s5cmd = "s5cmd.exe" ascii nocase
        $cloudflared = "cloudflared.exe" ascii nocase
        $remotely = "Remotely_Agent" ascii nocase
        $perflogs = "C:\\PerfLogs" ascii nocase
    condition:
        filesize < 5MB and 2 of them
}

title: PsExec Lateral Movement With Host List File
id: 8f2c1a44-6b7e-4d19-9a03-2c5e7b1d4f60
status: experimental
description: Detects PsExec execution referencing a host list file, a pattern Microsoft attributes to Storm-2570 lateral movement and MeshAgent deployment.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
author: Adverse Trace
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:

      - '\psexec.exe'
      - '\psexec64.exe'
  selection_cli:
    CommandLine|contains: '@ip.txt'
  condition: selection_image and selection_cli
falsepositives:

  - Legitimate administrative use of PsExec with a host list file
level: high

title: Active Directory Database Snapshot via ntdsutil IFM
id: 3d9b7e21-4a58-4c6f-b0d2-7e1f9a3c5b84
status: experimental
description: Detects ntdsutil creating an Install From Media copy of the Active Directory database, the credential dumping technique Microsoft attributes to Storm-2570.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
author: Adverse Trace
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\ntdsutil.exe'
    CommandLine|contains|all:

      - 'activate instance'
      - 'ifm'
  condition: selection
falsepositives:

  - Scheduled or manual Active Directory backup procedures using ntdsutil IFM
level: high

title: Microsoft Defender Tampering Preceding Ransomware Deployment
id: c71e5f08-2b93-4a6d-8e14-5f0a7c2d9b31
status: experimental
description: Detects modification of Microsoft Defender anti-spyware and real-time monitoring values, or addition of the C:\PerfLogs exclusion path, both attributed to Storm-2570 defence evasion.
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
author: Adverse Trace
date: 2026/09/24
logsource:
  category: registry_set
  product: windows
detection:
  selection_values:
    TargetObject|endswith:

      - '\DisableAntiSpyware'
      - '\DisableRealtimeMonitoring'
  selection_exclusion:
    Details|contains: 'C:\PerfLogs'
  condition: selection_values or selection_exclusion
falsepositives:

  - Endpoint management tooling that writes Defender configuration during onboarding
level: high

7. Sources

• Microsoft Security Blog, "Beyond the ransomware: Tracking Storm-2570's consistent tradecraft across deployments", https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/, 2026-09-24.

This is the only source for this advisory. No CVE record, CISA KEV entry, EPSS score or MITRE ATT&CK profile exists for Storm-2570 in our reference data.

8. Adverse Trace position

No CVE, CVSS score or CISA KEV entry applies here, so we are not assigning a vulnerability severity. The relevant assessment is actor-driven: a single affiliate with a stable tooling set that has already reached financial services organisations in Spain, the Netherlands and the UK, and that exfiltrates through cloud storage before encrypting. The tooling is commodity and dual-use, which cuts both ways: it is easy for the actor to obtain and easy for a defender to detect once the right telemetry is in place. We treat the attribution as unconfirmed, since Storm-2570 is Microsoft's tracking designation and has no MITRE ATT&CK profile in our reference data, and the entire tooling set is single-sourced to Microsoft. We will hunt the named RMM components, the Cloudflare Tunnel and ngrok outbound paths, the C:\PerfLogs Defender exclusion, ntdsutil IFM output under C:\Windows\Temp and s5cmd or Rclone execution across client estates, and report back on any match. Clients who want the section 6 rules tuned to their own log schema should contact their Adverse Trace handler.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.