Microsoft names Storm-2570, the affiliate hopping between Qilin, DragonForce and other ransomware crews

Key points

• Microsoft Threat Intelligence says a single affiliate it calls Storm-2570 has deployed four different ransomware strains: Qilin, DragonForce, Anubis and BERT.
• The group has been tracked since April 2025 and has hit organisations in the United States, Canada, United Kingdom, Spain, the Netherlands and Puerto Rico, including hospitals, schools and government agencies.
• Storm-2570 uses ordinary IT tools already trusted inside networks, including Atera, Splashtop, ScreenConnect and MeshAgent, often renamed to match the victim's company name.
• Microsoft says the affiliate opens hidden outbound tunnels using Cloudflare's own tunnelling software, letting intruders slip past firewalls that only inspect incoming traffic.
• The victims span more than a dozen sectors, from healthcare and energy to food, agriculture and financial services.

A new report from Microsoft Threat Intelligence makes a point that ought to reshape how boards read ransomware headlines: the ransom note on the screen tells you very little about who actually broke in.

Microsoft has assigned the name Storm-2570 to one affiliate, a freelance intruder who rents access to different ransomware brands and picks whichever pays best on a given job. Since April 2025, this single operator has deployed Qilin, DragonForce, Anubis and BERT ransomware across separate intrusions. Ransomware is malicious software that scrambles a company's files and demands a payment to unscramble them. We've covered Qilin across five stories since late June, and DragonForce first appeared in our coverage on 22 July.

The victims Microsoft lists span hospitals, schools, energy firms, food and agriculture businesses, retailers and government offices across six countries.

Why does one hacker using four ransomware brands matter?

Because most defensive playbooks are written around the brand, not the person. If your incident response plan is tuned to spot Qilin, you may miss the same intruder when they arrive carrying a BERT payload the following week.

Microsoft's argument in plain terms: the payload changes, the tradecraft doesn't. Storm-2570 reuses the same remote access tools, credential theft steps and data-stealing utilities regardless of which ransomware crew is paying them that month. Spot the behaviour and you catch the person before the encryption starts.

How does Storm-2570 get around inside a network?

With software most IT teams already have on an approved list. That's the uncomfortable part.

The affiliate leans on remote monitoring and management tools, the kind help desks use to log into staff laptops. Microsoft names Atera, MeshAgent, ScreenConnect, Splashtop, NinjaRMM and Remotely_Agent among them. In several cases the intruders renamed the MeshAgent binary to include the victim company's name, so it looked like an internal tool sitting on the machine. Commands were then Base64-encoded, a standard technique for hiding instructions in plain text, to obscure what was being run.

For lateral movement they use NetScan, Nmap, PsExec, Impacket and NetExec. Credential theft runs through Mimikatz, LaZagne and pypykatz, while ntdsutil targets Active Directory, the master directory of user accounts, to pull every credential at once. Rclone and s5cmd, both legitimate cloud file-transfer programs, handle exfiltration.

In one intrusion Microsoft describes, the affiliate installed Cloudflare's tunnelling software as a Windows service running under the system's highest-privilege account. That gave them a persistent encrypted path out of the network that ordinary firewall rules don't catch.

What should this change for ordinary organisations?

Two practical things. Watch the tools, not the brand. Treat any unexpected remote-management agent on a machine as a possible intrusion, even if your IT team recognises the product name.

My read, having followed this beat for a while: Microsoft's naming of Storm-2570 is the more honest way to describe the modern ransomware market. Leak-site brand names are marketing. The affiliate's the business, and that's who defenders need to be tracking.