Storm-2570 Reuses Remote Access to Steal Data and Deploy Ransomware

The ransom note may say Qilin or DragonForce. Storm-2570 used the same post-compromise playbook across those payloads. In investigated intrusions published September 24, Microsoft Threat Intelligence tracked Storm-2570 using recurring remote-management tools, credential theft and cloud data transfers before deployments involving Qilin, DragonForce, Anubis and BERT ransomware. That gives Windows and identity teams a way to recognize the intrusion before its final payload arrives.

Microsoft has followed Storm-2570 since April 2025 and investigated intrusions in the United States, Canada, United Kingdom, Spain, Netherlands and Puerto Rico, across healthcare, education, government, finance and other sectors. Microsoft is also the vendor evaluating its own Defender controls in this report.

Remote agents outlast ransomware names

Microsoft describes Storm-2570 as a ransomware affiliate moving among ransomware-as-a-service operations. Its first foothold remains unconfirmed, so start the hunt at the observed post-compromise tools rather than assigning an entry vector. The repeated pattern is remote access, host and network discovery, credential access, security tampering, lateral movement, data theft and encryption.

MeshAgent appears repeatedly. In one intrusion, the affiliate used MeshAgent alongside NinjaRMM, then ran ntdsutil.exe to obtain domain credential material, scanned the network and deployed Qilin. The actor also renamed meshagent64 binaries with victim-themed names such as meshagent64-[organization name].exe, and obscured some commands with Base64. A service with a plausible organization name deserves the same scrutiny as a plainly named remote agent.

In another case, Microsoft says Storm-2570 created “a persistent Cloudflare Tunnel service on the victim host” after installing MeshAgent. The tunnel ran automatically as LocalSystem and provided an outbound encrypted path. The same report describes Atera issuing commands and installing Splashtop Streamer, with ScreenConnect and Remotely_Agent appearing in other intrusions. These are legitimate administration products; the concern is an unapproved installation linked to the later credential and transfer activity.

Domain copies and transfer tools

On domain controllers, Microsoft observed Storm-2570 use ntdsutil.exe to create an Install From Media copy of NTDS.dit and related registry hives under C:\Windows\Temp\<XXXXXXXXX>. That operation provides material for offline credential extraction after the actor has obtained high privilege. In other observed chains, the actor used Mimikatz, LaZagne or pypykatz for credential access, and NetScan, Nmap or native commands to map reachable systems.

The actor used PsExec, Impacket, NetExec, admin shares and RDP scripts to reach more machines. Microsoft cites @ip.txt host lists used with PsExec, and rdp.bat enabling inbound RDP on 3389; it also observed ngrok exposing RDP. Correlate those filenames and process relationships with the RMM installation and initiating account; PsExec also runs legitimate administration jobs.

Microsoft reports Defender real-time monitoring disabled, the C:\PerfLogs antivirus exclusion added, and DisableAntiSpyware, DisableRealtimeMonitoring and WinDefend behavior altered in multiple intrusions. For exfiltration, Storm-2570 staged s5cmd.exe with a credentials file to copy selected business files to attacker-controlled S3 buckets; it also used Rclone. Preserve the staged transfer utility and credentials file; inspect process command lines for s5cmd.exe copy commands and available network egress logs for transfers to their destinations. In the chains Microsoft describes, cloud data theft could precede ransomware deployment.

Follow the chain in endpoint telemetry

Start in process, file, service and registry telemetry on systems that acquired an unexpected remote agent. Microsoft’s hunting examples correlate meshagent, meshagent64 and meshcentral across DeviceProcessEvents, DeviceFileEvents and DeviceRegistryEvents, including renamed binaries and service entries. Pivot to ntdsutil.exe on domain controllers, PsExec activity referencing @ip.txt, Defender-setting changes and s5cmd.exe or Rclone execution. Compare device, initiating account, command line, timestamp and destination against your approved administration and backup jobs. Individual dual-use tools are weak evidence; this sequence and its account context are much stronger.

Microsoft’s Defender for Endpoint detection names include Suspicious Atera activity, Attempt to turn off Microsoft Defender Antivirus protection, Possible data exfiltration and Renaming of legitimate tools for possible data exfiltration. Review an alert’s device timeline even when the ransomware-family alert has yet to fire. On a domain controller, investigate an IFM copy as privileged credential exposure and rotate affected credentials as part of containment, while preserving the process and file history for response.

Restrict remote management and tampering

Remove unauthorized RMM agents and tunnel services after preserving evidence, revoke their access and reset credentials for the accounts that installed them. Microsoft advises further investigation when a system-level account installed the software. Allow approved RMM installations only through controlled deployment and enforce MFA where supported. Restrict outbound tunnel services to approved use and make their service creation visible; inbound firewall rules alone will not stop a service-initiated outbound tunnel.

Turn on tenant-managed tamper protection and verify the setting on onboarded Windows endpoints. Microsoft’s tamper-protection documentation says enabled protection blocks changes to real-time protection and registry settings; protection of organization-managed exclusions depends on the documented configuration conditions. Use DisableLocalAdminMerge where appropriate for your management method, and verify the effective exclusion list no longer contains the attacker’s C:\PerfLogs entry. A Group Policy change can appear to succeed while tamper protection blocks it, so check the endpoint’s effective state.

For lateral movement, pilot the ASR rule Block process creations originating from PSExec and WMI commands on compatible devices. Microsoft warns about compatibility on some server systems and specifically cautions Configuration Manager users against other deployment methods for that rule because its client relies on WMI. Set the supported rule to Block where the pilot allows it; confirm the policy reached the intended endpoints and review block events alongside legitimate admin workflows.

Verify access is gone

On affected devices, compare installed services and recent process events with your approved RMM inventory, inspect the domain controller for ntdsutil.exe IFM activity, and trace any s5cmd.exe or Rclone process to a transfer destination. Remove unauthorized remote agents and tunnels, revoke their credentials, restore protected Defender settings and test the selected ASR policy. The expected result is approved remote-management services only, effective real-time protection without the malicious exclusion, and no new unauthorized tunnel or cloud-copy process after containment. A Qilin-only alert would miss the same affiliate’s activity before another payload arrives.