Microsoft Publishes Defender Hunts for Storm-2570 Ransomware

The research comes from Microsoft's own incident investigations. Coverage elsewhere so far republishes or summarizes Microsoft's post, and nobody else has independently confirmed these intrusions. Microsoft is authoritative on what it observed and recommends. The attribution to one actor, though, is Microsoft's assessment.

Storm-2570 Rotates Qilin, DragonForce, Anubis and BERT but Keeps One Playbook​

Storm-2570 is a ransomware affiliate that Microsoft Threat Intelligence has tracked since April 2025, and Microsoft assesses that it has operated across multiple ransomware as a service (RaaS) ecosystems, including Qilin, DragonForce, Anubis, and BERT. In the RaaS model, one group builds and runs the ransomware platform. Affiliates such as Storm-2570 break into networks, deploy the payload and share the proceeds. Microsoft describes Storm-2570 as moving between these operations as opportunities come up, which lets it use several families and improves its chances of getting paid.

The victims Microsoft investigated were in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico. The sector list is broad: healthcare and public health, education, government, financial services, energy, retail, IT, food and agriculture, commercial facilities, NGOs, chemicals, critical manufacturing and transportation. Nothing in that list points to a sector-specific campaign. Storm-2570 looks opportunistic.

Microsoft's main point is that across multiple investigations, Storm-2570 has maintained largely uniform tradecraft, infrastructure overlaps, and repeated use of the same remote access and cloud exfiltration tooling despite operating across multiple ransomware ecosystems. If a team files one incident under Qilin and another under DragonForce, it may never realize the same operator was behind both, using the same tools in the same order. Microsoft is also clear that none of this is new. Although Storm-2570's techniques are not novel, recognizing the patterns used by ransomware affiliates can be important for defenders to know to improve prevention, detection, and incident response.

One gap affects planning: Microsoft has not confirmed how Storm-2570 gets in. The report starts after the foothold. It does not name a phishing lure, an exploited vulnerability or a stolen-credential route, and none should be read into it. Everything below is post-compromise behavior. That makes it most useful for detection and containment, and less useful for perimeter hardening.

MeshAgent, Atera and Cloudflared Form Storm-2570's Remote Access Backbone​

Microsoft lists six remote monitoring and management (RMM) products seen across Storm-2570 incidents: Atera, MeshAgent, ScreenConnect, Splashtop, Remotely_Agent and NinjaRMM. These are legitimate admin tools. The problem is attacker-installed copies that the victim's IT team never approved.

MeshAgent, the endpoint agent for the open-source MeshCentral remote management server, comes up most often. Microsoft says it appears at key points in the attack chain. In several cases MeshAgent and MeshCentral acted as a bridge between early hands-on-keyboard activity and later steps: account manipulation, discovery, credential access, security tampering and ransomware deployment. Storm-2570 renames the MeshAgent binaries or services to match the victim, producing names like meshagent64-[organization name].exe so the agent looks like part of the company's own tooling. It also Base64-encodes the commands it runs through the agent. In one intrusion, MeshAgent ran alongside NinjaRMM before the attacker moved on to ntdsutil credential dumping, network scanning and Qilin deployment.

The group also layers several tools in the same network. Microsoft saw Atera used to install agents and run interactive commands, and AteraAgent used to download and install Splashtop Streamer. Splashtop appears to be the interactive remote-control piece delivered through Atera. ScreenConnect handled command execution and account or domain reconnaissance, and Remotely_Agent was installed as a persistent remote management service.

Tunneling adds another way back in. Microsoft reports that ngrok and Cloudflared.exe were used to expose RDP services or set up persistent outbound tunnels. In one case, Storm-2570 installed MeshAgent and later created a persistent Cloudflare Tunnel service that started automatically under the LocalSystem account. That gave the attacker an encrypted outbound channel from inside the network. Because the connection starts from inside, inbound firewall rules do not stop it. Inbound-only filtering will not catch this pattern, so outbound tunnel services on servers deserve their own review.

ntdsutil and Defender Tampering Signal Domain-Level Compromise​

After gaining remote access, Storm-2570 maps the network with NetScan, SoftPerfect Network Scanner Portable and Nmap, along with built-in Windows discovery commands and file searches. The aim is to find reachable hosts, services, shares and files worth stealing or encrypting. For credentials, Microsoft observed Mimikatz, LaZagne and pypykatz.

The most serious credential step uses a built-in Windows tool. Storm-2570 runs ntdsutil.exe to activate the NTDS Active Directory instance and create a full Install From Media (IFM) backup in C:\Windows\Temp\ under a randomized folder name. IFM exists so administrators can seed new domain controllers without replicating the whole directory over the network. In an attacker's hands, it produces a copy of NTDS.dit, the Active Directory database, plus the registry hives needed to extract password hashes offline. Microsoft says this activity shows the actor has high-privilege access to a domain controller. By that point, a whole-domain credential reset is a realistic part of recovery.

Defender tampering comes next. Microsoft says that in multiple intrusions Storm-2570 turned off real-time monitoring, added a Defender exclusion for C:\PerfLogs, and changed registry values under Defender service keys, including DisableAntiSpyware, DisableRealtimeMonitoring and the behavior of the WinDefend service. Microsoft tied this pattern to intrusions involving Qilin, DragonForce and Anubis.

The PerfLogs exclusion is worth checking for. The folder exists by default on Windows, so it gives an attacker a place to stage files that Defender will skip. A Defender exclusion for PerfLogs that nobody in IT set up should be treated as an incident, not a configuration mistake.

PsExec, rdp.bat and ngrok Turn One Foothold Into a Domain-Wide Deployment​

Microsoft calls PsExec one of Storm-2570's most consistent lateral movement and deployment tools. PsExec is the Sysinternals utility for running processes on remote Windows machines. The group often gives it a host list, such as @ip.txt, to run commands on many machines at once, and uses it to push renamed MeshAgent binaries onto newly compromised systems. The result is a remote-access agent on every machine it reaches, not just the first one.

RDP is the second channel. Microsoft describes an rdp.bat script that changes Terminal Server settings to allow inbound Remote Desktop connections and adds a firewall rule for TCP port 3389. In several intrusions, PsExec ran rdp.bat across hosts from the @ip.txt list. Enabling RDP where policy blocks it requires admin rights. So if RDP suddenly turns on across many machines, someone has administrative control. Storm-2570 also used ngrok to expose TCP 3389 to the internet, and PsExec activity and security tampering followed.

Impacket and NetExec running over SMB complete the set. Impacket is an open-source collection of Python classes for working with network protocols. Microsoft says attackers like it because it is easy to use and does a lot. The group used a NetExec SMB command for credential theft and reconnaissance against internal Windows hosts, and administrative shares for staging tools. Microsoft notes that these lateral-movement tools usually appear after discovery and credential theft, and often come before s5cmd exfiltration or the ransomware itself. That order is what gives defenders time to respond.

s5cmd Exfiltration to S3 Sets Up the Double Extortion​

Storm-2570 steals data before encrypting it. Microsoft observed Rclone and, more often, s5cmd, a command-line tool for Amazon S3 and S3-compatible object storage. The pattern repeats across cases. The attacker finds high-value drives and network shares, places s5cmd.exe next to a credentials file holding AWS access keys, and runs copy operations filtered by file extension. The targets are documents, spreadsheets, images, databases, mail-related files and archives, sent to S3 buckets the attacker controls.

Rclone works differently. Microsoft says its sync feature can push newly created or updated files to cloud storage as they change, so theft can continue through every stage of the attack without the attacker stepping in. Either way, the theft happens before the ransom note appears. Restoring from backups deals with the encryption, but the stolen data stays with the attacker as leverage.

The detection opening is that s5cmd is rarely part of a normal Windows file-server setup. If s5cmd.exe appears next to a file containing AWS keys on a machine that has no reason to talk to S3, it should be investigated, whatever ransomware family is involved.

Microsoft's Defender Hardening and Sentinel Hunts for Storm-2570​

Microsoft's mitigations focus on stopping the tampering and lateral-movement steps described above. The recommendations for Defender customers are:

1. Turn on tenant-wide Defender tamper protection. Microsoft warns that without it, attackers can turn off Defender Antivirus without needing more privileges.
2. On devices managed through Intune or Microsoft Defender for Endpoint Security Configuration, enable DisableLocalAdminMerge. This stops antivirus exclusions from being changed through Group Policy and directly addresses the PerfLogs exclusion trick.
3. Enable and configure Defender Antivirus always-on protection in Group Policy.
4. If a device has trouble during rollout, put it in Troubleshooting mode. This temporarily lifts Tamper Protection on that one device without weakening organization-wide policy.
5. For approved RMM products, require MFA wherever the product supports it. If you find an unapproved RMM installation, reset the passwords of the accounts used to install it. If it was installed with a System-level account, investigate further.
6. Configure automatic attack disruption in Defender XDR, which is designed to contain attacks in progress.
7. Enable attack surface reduction (ASR) rules that block credential stealing from lsass.exe, execution of potentially obfuscated scripts, webshell creation on servers, process creation from PsExec and WMI commands, and use of copied or impersonated system tools. Also turn on advanced protection against ransomware.

The PsExec/WMI ASR rule comes with a documented caution. Microsoft says some organizations may see compatibility problems on certain server systems, but should still deploy the rule to other systems to stop lateral movement through PsExec and WMI. Where PsExec is part of legitimate server administration, test the rule in audit mode on servers first rather than applying it everywhere at once.

Microsoft maps named Defender detections to each stage of the attack. They include Behavior:Win32/PsexecRemote, the HackTool:Win32/Mimikatz and HackTool:Win64/Mimikatz families, LaZagne detections, and Defender for Endpoint alerts such as "Suspicious Atera activity", "Attempt to turn off Microsoft Defender Antivirus protection", "Renaming of legitimate tools for possible data exfiltration" and "Process memory dump". For the ransomware itself, Microsoft lists Ransom:Win32/Qilin, Ransom:Win32/DragonForce and Ransom:Win64/Anubis, among others. BERT is named as a deployed payload, but the published table has no BERT-specific antivirus signature. For BERT incidents, the behavioral detections earlier in the chain carry more of the weight.

Microsoft Sentinel customers get two advanced hunting queries, each covering the previous 30 days. The first searches DeviceProcessEvents for psexec.exe or psexec64.exe and filters to command lines containing @ip.txt, -accepteula or a backslash. The second searches DeviceProcessEvents, DeviceFileEvents and DeviceRegistryEvents for the strings meshagent, meshagent64 and meshcentral, which catches renamed binaries because the victim's name is added to the original file name rather than replacing it. Defender XDR customers with a license for at least one Defender XDR product can also open the Storm-2570 actor profile and the Qilin, Anubis and DragonForce tool profiles in the threat analytics section of the Defender portal.

What this means for you​

If you run Windows domains, act on this now instead of waiting for a signature. Every stage Microsoft describes leaves traces in Defender and Windows logs before any encryption starts. Security teams on Defender for Endpoint should run the two Sentinel hunts and review their tamper protection and ASR posture. Smaller shops without Defender XDR can still check for the same artifacts by hand. Home users and unmanaged PCs are not the audience here: Storm-2570 goes after organizations with Active Directory domains.

• Run a 30-day hunt for PsExec with @ip.txt host lists and for any file, process or registry entry containing meshagent, meshagent64 or meshcentral, including names with a company name appended.
• Inventory every RMM agent in the environment, including Atera, ScreenConnect, Splashtop, NinjaRMM, MeshAgent and Remotely_Agent. Treat any unapproved one as a compromise indicator, and reset the passwords of the accounts that installed it.
• Enable tenant-wide tamper protection. On Intune or Defender for Endpoint Security Configuration devices, set DisableLocalAdminMerge so Group Policy cannot add exclusions such as C:\PerfLogs.
• Alert on ntdsutil IFM activity that writes to C:\Windows\Temp. If you confirm it, assume every domain credential is exposed and plan a full reset.
• Look for Cloudflared or ngrok services running as LocalSystem, sudden firewall rules opening TCP 3389, and s5cmd.exe or Rclone on file servers.
• Deploy the PsExec/WMI ASR rule to workstations right away. On servers, test it in audit mode first, as Microsoft's own compatibility warning suggests.

Storm-2570 moves between Qilin, DragonForce, Anubis and BERT, but its route to encryption stays the same: a rogue RMM agent, a copied NTDS.dit, Defender switched off, PsExec across a host list, and s5cmd sending files to S3. Organizations that detect and block those steps are protected whichever ransomware brand this affiliate uses next, and Microsoft's published hunts and ASR rules give them a way to start.