storm-2570

Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence, reported in September 2026 as attacking organizations across North America and Europe. Rather than relying on a single payload, the group has deployed Qilin, DragonForce, Anubis and BERT ransomware, but its Windows intrusion playbook stays consistent: rogue remote-management agents, NTDS.dit credential theft, Microsoft Defender tampering, PsExec lateral movement and S3-based data theft. For Windows defenders, the practical takeaway is that the ransomware brand on the ransom note matters far less than the pre-encryption behavior, which is visible in ordinary Windows telemetry and Microsoft Defender hunting queries.