Storm-2570 Ransomware Affiliate: Detecting Consistent Tradecraft Across Qilin, DragonForce, Anubis, and BERT Deployments

Microsoft Threat Intelligence has published new research on Storm-2570, a ransomware affiliate operator that distinguishes itself not through novel tooling, but through consistency. Across deployments of four different ransomware families — Qilin, DragonForce, Anubis, and BERT — Storm-2570 reuses the same post-compromise tools, techniques, and procedures. That consistency is a gift to defenders: while the final encryption payload changes, the hands-on-keyboard activity preceding it is highly predictable and detectable.

This is the critical insight for SOC teams. If you are hunting for ransomware families one payload at a time, you are fighting yesterday's war. Affiliates like Storm-2570 swap encryptors based on RaaS availability, profit splits, and law-enforcement pressure — but their intrusion tradecraft remains stable. Detecting the operator's behavior before the encryptor touches disk is the difference between a contained incident and a business-halting encryption event.

What Is at Risk

Any organization reachable via exposed remote services, compromised credentials, or vulnerable perimeter appliances is in scope for affiliate-driven ransomware. Storm-2570's cross-family activity demonstrates a mature, repeatable intrusion lifecycle: initial access, credential theft and privilege escalation, lateral movement, staging of the encryptor, and mass deployment — typically domain-wide via administrative tooling. Once deployment begins, defenders have minutes to hours, not days. Organizations in healthcare, manufacturing, professional services, and local government remain disproportionately targeted by the ransomware-as-a-service (RaaS) ecosystem that affiliates like Storm-2570 feed.

Technical Analysis: Why Tradecraft Beats Payloads

The affiliate model and Storm-2570's position

Storm-2570 operates as an affiliate in the RaaS economy. Rather than developing its own encryptor, it leases payloads from multiple RaaS programs and focuses on what it does well: gaining access and deploying at scale. Microsoft's tracking shows the same operator behaviors surfacing across Qilin, DragonForce, Anubis, and BERT incidents — strong evidence of a single operational playbook applied regardless of which encryptor is in the final stage.

The attack chain, from a defender's perspective

While initial access vectors vary, Storm-2570's post-compromise activity follows a recognizable pattern consistent with high-tempo ransomware affiliates:

Discovery and enumeration — use of built-in Windows utilities (net.exe, nltest, quser, ipconfig, arp) and Active Directory reconnaissance to map the environment and identify high-value targets (domain controllers, backup servers, hypervisors, file shares).
Credential access and privilege escalation — dumping credentials from LSASS memory and harvesting stored credentials, followed by use of legitimate administrative accounts to move laterally without dropping obvious malware.
Lateral movement and staging — abuse of administrative protocols (SMB admin shares, RDP, WinRM) and tools like PsExec to push payloads; staging directories in writable locations such as C:\ProgramData and C:\Users\Public.
Defense evasion — disabling or tampering with security tooling, clearing Windows event logs (wevtutil cl), and — critically — destroying recovery options by deleting Volume Shadow Copies (vssadmin delete shadows, wmic shadowcopy delete) and modifying boot configuration with bcdedit to suppress recovery options.
Deployment and impact — mass distribution of the encryptor across the domain, often via PsExec, Group Policy, or scheduled tasks, followed by simultaneous execution.

None of these behaviors are exotic. That is precisely the point. Every stage leaves durable, high-fidelity telemetry in Windows event logs, EDR process lineage, and network flow data. An operator who behaves the same way across four ransomware families is an operator you can build durable detections against.

Exploitation status

This is confirmed, active, in-the-wild threat actor activity tracked by Microsoft across multiple ransomware ecosystems. There is no single CVE at the center of this reporting — the risk is behavioral, and so the defense must be behavioral. Organizations should treat Storm-2570's tradecraft as an active threat requiring immediate hunt and detection validation.

Detection & Response

The detections below target the most consistent, highest-signal phases of Storm-2570's playbook: shadow copy destruction and recovery tampering, encryptor staging and mass deployment via PsExec, and event log clearing. These are behaviors a mature SOC should already be alerting on — if you are not, close that gap today.

Sigma Rules

YAML

---
title: Shadow Copy Deletion and Boot Recovery Tampering
description: Detects deletion of Volume Shadow Copies and modification of boot configuration to suppress recovery options — consistent pre-encryption behavior observed across Storm-2570 ransomware deployments.
author: Security Arsenal
date: 2026/09/25
id: 8b2f4c11-7a3d-4e9f-b1c6-2d5e8a9f0c31
status: experimental
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
  - https://attack.mitre.org/techniques/T1490/
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\WMIC.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Legitimate storage administrators resizing shadow storage (rare on servers outside change windows)
  - Backup software managing shadow copies (validate against known backup tool parent processes)
level: high
---
title: Remote Service Execution via PsExec-Style Service Binary
description: Detects execution of PsExec and PsExec-like remote service binaries, commonly used by Storm-2570 for mass encryptor staging and domain-wide ransomware deployment.
author: Security Arsenal
date: 2026/09/25
id: 3c7e9a52-1b4f-4d8c-a2e7-5f9b1c3d6e84
status: experimental
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
  - https://attack.mitre.org/techniques/T1569/002/
  - https://attack.mitre.org/techniques/T1021/002/
logsource:
  category: process_creation
  product: windows
detection:
  selection_named:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\psexec64.exe'
  selection_renamed:
    CommandLine|contains:
      - ' -accepteula'
      - '\\\\'
    CommandLine|contains:
      - ' -s '
      - ' -d '
  selection_staging_path:
    Image|contains:
      - '\Users\Public\'
      - '\ProgramData\'
    Image|endswith: '.exe'
    ParentImage|endswith:
      - '\psexesvc.exe'
      - '\services.exe'
  condition: selection_named or (selection_renamed and selection_staging_path)
falsepositives:
  - Enterprise software distribution and systems management tools using PsExec
  - IT administrators performing legitimate remote execution
level: medium
---
title: Windows Event Log Clearing via wevtutil or PowerShell
description: Detects clearing of Windows event logs using wevtutil or PowerShell Clear-EventLog, a defense-evasion behavior consistent with Storm-2570 pre-deployment activity.
author: Security Arsenal
date: 2026/09/25
id: 5d1a8e74-9c2b-4f6d-b8a3-7e0c4f2a9b65
status: experimental
references:
  - https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/
  - https://attack.mitre.org/techniques/T1070/001/
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - ' clear-log '
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Clear-EventLog'
      - 'Remove-EventLog'
  condition: 1 of selection_*
falsepositives:
  - Log rotation scripts in some environments (uncommon; validate scope)
  - System maintenance tooling
level: high

KQL Hunt — Microsoft Sentinel / Defender

This query correlates the two highest-signal pre-encryption behaviors — shadow copy tampering and PsExec-style staging — within a tight time window on the same device. A match on both within 30 minutes is a near-certain indicator of hands-on ransomware preparation and should page the on-call IR team.

KQL — Microsoft Sentinel / Defender

let Lookback = 7d;
let TamperEvents = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled", "ignoreallfailures"))
   or (FileName =~ "wevtutil.exe" and ProcessCommandLine has " cl ")
| project TamperTime=TimeGenerated, DeviceId, DeviceName, TamperCommand=ProcessCommandLine, AccountName;
let StagingEvents = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName has_any ("psexec", "psexesvc"))
   or (FolderPath has_any ("\\Users\\Public\\", "\\ProgramData\\") and InitiatingProcessFileName has "psexesvc")
| project StagingTime=TimeGenerated, DeviceId, StagingCommand=ProcessCommandLine, StagingFile=FileName;
TamperEvents
| join kind=inner StagingEvents on DeviceId
| where abs(datetime_diff('minute', StagingTime, TamperTime)) <= 30
| project DeviceName, AccountName, TamperTime, TamperCommand, StagingTime, StagingFile, StagingCommand
| sort by TamperTime desc;

For a broader hunt across Defender environments where you may not have both signals correlated, also sweep for service creation on remote hosts (Security Event 7045 ingested to Sentinel) with suspicious binary paths:

KQL — Microsoft Sentinel / Defender

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 7045
| where ServiceFileName has_any ("\\Users\\Public\\", "\\ProgramData\\", "ADMIN$", "C$\\Windows\\")
   or ServiceName has "PSEXESVC"
| project TimeGenerated, Computer, Account, ServiceName, ServiceFileName, ServiceStartType
| sort by TimeGenerated desc;

Velociraptor VQL

Use this artifact during scoping to identify hosts with evidence of shadow copy tampering or executables staged in common ransomware staging locations — a fast triage sweep across the fleet when you suspect Storm-2570-style activity.

VQL — Velociraptor

-- Storm-2570 tradecraft hunt: staged executables and recovery-tampering processes
LET staged = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/Public/*.exe', 'C:/ProgramData/*/*.exe', 'C:/Windows/Temp/*.exe'])
WHERE NOT FullPath =~ '(?i)(\\microsoft\\|\\windows defender\\|known_good_paths)'

LET tamper = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|wevtutil.{0,20}cl )'

SELECT * FROM staged
UNION ALL
SELECT FullPath=Exe, Size=NULL, Mtime=CreateTime FROM tamper

For tighter results in production, split staged and tamper into separate artifacts and enrich staged with authenticode signature checks and hash lookups against your allowlist before paging on results.

Hardening and Verification Script

Run this PowerShell on servers and via your RMM across endpoints to verify that the most commonly abused pre-encryption levers are locked down and observable.

PowerShell

# Storm-2570 tradecraft hardening and verification
# Run elevated. Review output for anything flagged [ACTION REQUIRED].

Write-Host "=== Volume Shadow Copy status ===" -ForegroundColor Cyan
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
} else {
    Write-Warning "[ACTION REQUIRED] No shadow copies present. Verify VSS is enabled and scheduled for critical volumes."
}

Write-Host "=== BCD recovery settings (ransomware often disables these) ===" -ForegroundColor Cyan
bcdedit /enum {current} | Select-String -Pattern "recoveryenabled|bootstatuspolicy"

Write-Host "=== Tamper Protection / Defender state ===" -ForegroundColor Cyan
$mp = Get-MpComputerStatus
if (-not $mp.IsTamperProtected) { Write-Warning "[ACTION REQUIRED] Tamper Protection is OFF. Enable via Intune or Security portal." }
if (-not $mp.RealTimeProtectionEnabled) { Write-Warning "[ACTION REQUIRED] Real-time protection is DISABLED." }

Write-Host "=== Block PsExec-style remote service execution via firewall (inbound admin shares unchanged; this blocks service control where policy allows) ===" -ForegroundColor Cyan
Write-Host "Verify PsExec is not present outside approved admin tool locations:"
Get-ChildItem -Path C:\Users\Public, C:\ProgramData, C:\Windows\Temp -Recurse -Filter *.exe -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'psexec|psexesvc|paexec|remcom' } |
    Select-Object FullName, Length, LastWriteTime

Write-Host "=== Audit policy: ensure command-line logging and service install auditing ===" -ForegroundColor Cyan
auditpol /get /subcategory:"Process Creation"
auditpol /get /subcategory:"Security System Extension"
# Enable process command line capture if not set:
$reg = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if ((Get-ItemProperty -Path $reg -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Set-ItemProperty -Path $reg -Name ProcessCreationIncludeCmdLine_Enabled -Value 1
    Write-Host "Enabled ProcessCreationIncludeCmdLine_Enabled" -ForegroundColor Green
}

Write-Host "=== Forward critical events: 4688, 4697, 7045, 1102 to your SIEM ===" -ForegroundColor Cyan

Remediation and Disruption Guidance

Because Storm-2570's strength is operational consistency, your defense should be equally systematic:

Break the pre-encryption kill chain at its loudest point. Alerting on vssadmin delete shadows, bcdedit recoveryenabled no, and wmic shadowcopy delete remains one of the highest-fidelity ransomware pre-indicators available. These commands have near-zero legitimate use outside change windows on production servers. Wire them to high-severity paging, not a daily report.
Constrain lateral movement tooling. Block PsExec and PsExec-like tools (PAExec, RemCom, and renamed copies) via AppLocker or WDAC policies for all but a defined admin group. Monitor for service installations (Event 7045/4697) referencing ADMIN$, C$, ProgramData, or Users\Public paths.
Protect credentials and LSASS. Enable Credential Guard, enforce LAPS for local admin passwords, tier administrative accounts, and alert on non-system processes opening LSASS handles.
Harden recovery. Ensure Volume Shadow Copies exist and are tested, but treat them as convenience, not backup — affiliates destroy them first. Maintain offline or immutable backups (object-lock, air-gapped, or logically isolated) and test restoration quarterly.
Tamper-proof the security stack. Confirm Microsoft Defender Tamper Protection is enabled tenant-wide, and alert on any attempt to disable real-time protection, add Defender exclusions, or stop security services.
Hunt on operator behavior, not payload names. Build and maintain detections against the intrusion lifecycle — enumeration bursts, credential access, staging in public directories, log clearing — because the encryptor name will keep changing (Qilin today, DragonForce or BERT tomorrow).
If you detect Storm-2570 activity pre-encryption: isolate the affected host immediately, assume credential compromise domain-wide if a domain controller or jump host is involved, disable the staging account, and invoke your IR retainer. Speed here is measured in minutes.

Review Microsoft's full analysis for additional indicators and actor-specific context: Microsoft Security Blog — Beyond ransomware: Tracking Storm-2570's consistent tradecraft across deployments. Cross-reference the #StopRansomware guides from CISA for the Qilin and related families for family-specific indicators.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub