Storm-2570 ransomware affiliate: consistent tradecraft across Qilin, DragonForce, Anubis, BERT

Fri, 25 Sep 2026 15:49:12 +0000

Engineer — Learn: No exploitable vulnerability or patchable component here — this is post-compromise TTP analysis. Worth reviewing to understand how Storm-2570 stages before detonation, which could inform detection-oriented hardening of endpoint configs or logging.
SOC/IR — Act: Microsoft documents Storm-2570’s reusable pre-ransomware toolchain across four active ransomware families with defender detection guidance — review the full blog post, map identified TTPs to ATT&CK, and tune or create SIEM/EDR rules against the common tradecraft patterns before the next deployment hits.
Leader — Learn: A single-source threat-actor profile with no confirmed incident or sector-specific targeting disclosed; useful background for briefing on ransomware affiliate sophistication and the multi-group risk model, but no same-week action needed.

Ttp-Analysis on CuraSec