Four Payloads, One Intrusion Pattern
Microsoft links Storm-2570 to Qilin, Anubis, DragonForce and BERT deployments. The encryptor changed while earlier behaviour kept recurring. Tracking began in April 2025; the initial-access method remains unconfirmed.
Observed activity includes remote agents, stolen credentials, lateral execution, weakened protection and cloud transfers. Named tools include ScreenConnect, Rclone, Mimikatz and PsExec. These are investigated incidents, not a complete victim count; the tracking label does not prove that one individual performed every action.
A genuine tool can serve an intruder
CISA’s remote-management warning explains that legitimate software can provide unauthorised access, including through portable copies that need no installation. An installer inventory alone is insufficient. Establish who approved an agent, which tenant controls it, the initiating identity and the business purpose before treating it as legitimate or malicious.
The NCSC’s layered approach combines controls on remote access, privileges, execution and network movement. An approved utility does not make its user or destination trustworthy. Join endpoint, identity and network records to reconstruct what happened between access and transfer; waiting for an encryptor discards useful warning time.
Six actions before the ransom note
- Inventory remote agents. Record approved products, owners, tenants, installer identities and deployment paths. Investigate unexplained agents, new enrolments and tenant changes, including portable execution.
- Protect remote administration. Require multifactor authentication, restrict management access and use only necessary privileges. Separate privileged administration from routine browsing.
- Protect policy. Use tamper protection and centrally managed settings. Defender’s policy guidance describes controlling local overrides and exclusion-list merging; verify that local administrators cannot silently weaken the deployed policy, accounting for the supported platform and management method.
- Correlate the sequence. Connect WMI or other remote execution, secret theft, tunnels and object-storage transfers with their initiating accounts and hosts. A transfer utility in a backup job needs different context from an unexplained destination after credential theft.
- Hunt before encryption. The research linked above provides detection mappings and queries. Validate matches against normal administration, then investigate the surrounding activity rather than declaring compromise from a product name.
- Rehearse containment. Test how to revoke an unapproved tenant, block its infrastructure and isolate affected hosts. Keep response contacts and playbooks available when normal systems are unavailable.
BlackTree’s earlier remote-management analysis and report on rapid ransomware progression provide related defensive context. They establish no shared operator or infrastructure here. The practical comparison is the interval before impact: account control, reachability and a rehearsed response matter while the eventual payload is still unknown.
Source dates and evidence limits
The primary research was published on 24 September 2026 at 16:00 and modified at 16:26:38, both UTC. Those clocks are present in page metadata. The current source was checked on 27 October; this review did not test victim systems, telemetry or hunting queries.
