Microsoft researchers have linked a single ransomware affiliate — tracked as Storm-2570 — to intrusions that ended in at least four different ransomware payloads. The malware changed each time; the way the group broke in, moved around, and stole data before encrypting anything did not. That consistency is what let analysts connect cases that otherwise looked unrelated.
What happened
Once inside a network, Storm-2570 leans on legitimate remote monitoring and management (RMM) tools instead of custom malware to stay under the radar. MeshAgent shows up repeatedly, often renamed to look like a file tied to the victim's own organization, alongside MeshCentral, Atera, NinjaRMM, ScreenConnect and Splashtop. For outbound access, the group runs Cloudflare Tunnel with elevated privileges to open a quiet, encrypted channel out of the network, and uses ngrok to expose remote desktop access — both choices that blend into normal remote-work traffic instead of triggering alarms.
Credential theft follows a similar "use what's already trusted" logic: network scanners paired with Mimikatz, LaZagne and pypykatz to harvest passwords, plus the built-in Windows utility ntdsutil to pull a full copy of the Active Directory database. That single step can hand over every domain account's password hash at once. From there, the group disables real-time protection, carves out antivirus exclusions, tweaks registry settings, and spreads further using PsExec, Impacket or NetExec.
Before any ransomware runs, Storm-2570 stages a data-theft phase: the s5cmd utility copies documents, spreadsheets, databases and archives to attacker-controlled cloud storage, with rclone keeping files synced over time. That gives the group double-extortion leverage — the threat to leak stolen data holds even if a victim restores everything from backup.
Why it matters
Microsoft has not disclosed a victim count, financial impact, or how often these intrusions actually escalated from data theft to full ransomware deployment. What matters more than any single number is the pattern itself: the same operator profile has now turned up behind multiple, seemingly distinct ransomware brands. Similar abuse of legitimate remote-management software has already surfaced in unrelated ransomware cases, which means defenders can't treat "which ransomware family hit us" as the whole picture — the delivery and persistence playbook is the more durable signal.
What to do
- Require MFA on every remote-access and RMM tool, and treat any RMM installation outside normal change-management as suspicious until verified.
- Reset credentials for accounts used to install unapproved remote-access software.
- Alert on ntdsutil activity, unexpected Active Directory database exports, and unusual outbound transfers to cloud storage endpoints.
- Watch for RDP being enabled on systems that don't normally use it, and review antivirus exclusion lists for directories with no legitimate reason to be excluded.
- Prioritize catching the intrusion at the data-theft stage, before encryption — that's the window where detection still prevents the worst outcome.