Hunting ransomware by payload name alone hides the affiliates who actually break in. Microsoft Threat Intelligence shows in a September 24, 2026 report how Storm-2570 — an affiliate tracked since April 2025 — reuses the same post-compromise tradecraft across Qilin, DragonForce, Anubis and BERT. Even when the final payload changes, MeshAgent, Atera, ScreenConnect, PsExec, Impacket, ntdsutil, s5cmd and Rclone recur. That gives defenders a chance to detect and break the chain before encryption, even when the family name is unknown.
Storm-2570 has been observed in intrusions in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico against healthcare, education, government, finance, energy, retail, IT, food and agriculture, chemicals, manufacturing and transportation. Unlike actors tied to a single RaaS, Storm-2570 shifts ecosystems to maximise payouts. Initial access remains unconfirmed, but subsequent activity shows hands-on-keyboard work, RMM tools and tunnels. MeshAgent appears repeatedly — often renamed meshagent64-[organization].exe with Base64-obfuscated commands — as a bridge between early control and later account manipulation, discovery, credential access and ransomware. Atera installs agents and pulls Splashtop; ngrok and Cloudflared.exe expose RDP or create persistent outbound Cloudflare tunnels under LocalSystem.
After privilege escalation, Storm-2570 uses Mimikatz, LaZagne, pypykatz and ntdsutil to create Install From Media copies of Active Directory (NTDS.dit) under C:\Windows\Temp\. Defender protections are sabotaged: real-time monitoring disabled, exclusions added for C:\PerfLogs, and registry values such as DisableAntiSpyware/DisableRealtimeMonitoring altered. Lateral movement uses PsExec against host lists (@ip.txt), Impacket, NetExec over SMB, RDP batch scripts opening TCP 3389, and deployment of renamed MeshAgent binaries. Data theft often precedes ransom via s5cmd to attacker S3 buckets (with a credentials file) or Rclone for continuous sync — classic double extortion.
Microsoft's message to SOCs: measure behaviour — unexpected RMM installs, new Cloudflare/ngrok services, ntdsutil IFM, Defender exclusions in PerfLogs, PsExec waves and s5cmd/Rclone to S3. Mitigations include credential hygiene, least privilege, tenant-wide tamper protection, DisableLocalAdminMerge via Intune/MDE, and ASR rules against Impacket lateral movement. For Nordic organisations — especially healthcare, municipalities and industry — "we don't see Qilin" is not protection: the same affiliate may land BERT or Anubis next week with the same tool chain.
Concrete steps for IT and security leaders
1. Enable tamper protection and block local Defender exclusions (DisableLocalAdminMerge). 2. Alert on new/unknown RMM (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM) without a change ticket. 3. Monitor ntdsutil IFM, s5cmd/Rclone to cloud, and Cloudflared/ngrok as services. 4. Restrict PsExec/admin shares; enable ASR against Impacket lateral movement. 5. Rehearse IR on "pre-ransom": isolate on RMM+exfil, do not wait for .encrypted files.
Evidence Rail
- Confirmed: Microsoft Threat Intelligence report 24 September 2026; tool chain and sectors; links to Qilin/DragonForce/Anubis/BERT.
- Reported: Geographic spread of investigated intrusions.
- Unconfirmed: Storm-2570's exact initial-access vector.
In Brief
- Storm-2570 is a cross-ecosystem ransomware affiliate with stable tradecraft regardless of payload.
- MeshAgent, ntdsutil, Defender tampering and S3 exfil (s5cmd/Rclone) are recurring signals.
- Detect the affiliate before encryption — the family name is what changes last.