Across multiple intrusions leading to different ransomware payloads, the ransomware affiliate tracked as Storm-2570 has used consistent post-compromise tools and techniques over time, highlighting the value of monitoring recurring attacker behaviors rather than tracking payloads alone. https://msft.it/6045a9GNz Storm-2570 has used largely uniform tradecraft, including remote access, credential theft, lateral movement, security tampering, and data exfiltration, across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware. Read the latest Microsoft Threat Intelligence blog for a comprehensive analysis of Storm-2570 activity, as well as Microsoft Defender detections, hunting guidance, and relevant mitigation recommendations, including tamper protection, credential hygiene, and configuring automatic attack disruption.
Storm-2570 Ransomware Affiliate Tactics and Techniques
This title was summarized by AI from the post below.
More Relevant Posts
-
Since February 2026, Microsoft Defender Experts have tracked a cryptocurrency clipper campaign that combines clipboard theft, wallet address replacement, worm-like functionality, and Tor-based communications, enabling both financial gain and continued access to compromised devices. https://msft.it/6040vlu8G This campaign uses malicious .lnk files to deliver a worm and a script-based stealer. Upon execution, the clipper deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor. Due to the nature of this attack chain, defenders should hunt for correlated behaviors rather than investigate isolated events. Read our latest blog to get our full analysis, as well as detection and mitigation guidance to help security teams investigate and contain similar activity in enterprise environments.
-
Microsoft’s investigation into increased ACR Stealer activity surfaced two distinct intrusion paths that both begin with ClickFix, diverge in execution, but lead to the same outcome: the exfiltration of browser credentials, session tokens, and other sensitive data. https://msft.it/6041v2sn7 One attack chain uses WebDAV-delivered payloads, Python-based loaders, and blockchain-backed dead-drop infrastructure, while the other relies on fileless execution, obfuscated PowerShell, and steganography-assisted in-memory payload delivery. This research highlights how operators of malware-as-a-service (MaaS) infostealers like ACR Stealer are using multiple intrusion chains to achieve the same objective. Read our blog for technical analysis, along with protection, detection, and hunting guidance.
-
Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers in an operation we call CaptiveCrunch. https://msft.it/6048aBXBe Since early May 2026, the threat actor has conducted widespread but targeted traffic manipulation attacks involving networks served by captive portals. In some cases, users were redirected through actor-controlled phishing infrastructure, while other activity led to the delivery of malware on impacted systems. Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and details the malware, tradecraft, and cloud-focused techniques used throughout the campaign, including device code phishing and credential theft activity targeting travelers. Get detections, mitigation, and hunting guidance from this Microsoft Threat Intelligence blog post.
-
An active infostealer campaign targets macOS users and hosts malicious ClickFix-like instructions on blog sites. The campaign’s latest iterations take advantage of users looking for advice on macOS issues on popular blogs and other content platforms: https://msft.it/6040vMOGQ The instructions involve running commands that claim to install system utilities but instead load an infostealer that collects and exfiltrates data, including media files, iCloud data and Keychain entries, and cryptocurrency wallets. The campaign also instructs users to run Terminal commands leveraging native utilities, enabling the attackers to run malware without undergoing verification checks (for example, Gatekeeper) that typical application delivery methods are subjected to. Read the latest Microsoft Defender Research blog to learn more and to get best practices and guidance for detecting and mitigating ClickFix-related threats.
-
Based on leak site data tracked by Microsoft Threat Intelligence, The Gentlemen ransomware has claimed one of the highest victim counts among ransomware-as-a-service (RaaS) operations over the past three months, while Microsoft Defender detections on active ransomware offerings show it is the fourth most impactful payload after Akira, Qilin, and LockBit. https://msft.it/6040aHAbq Microsoft tracks the operators of The Gentlemen ransomware as Storm-2697, a financially motivated threat actor that manages the RaaS platform while affiliates carry out attacks. The ransomware combines strong per-file encryption with self-propagation capabilities, which could enable affiliates to expand access across compromised environments and increase the scale of an intrusion. Organizations can reduce risk by hardening identities, limiting privileged access, and leveraging endpoint detection and response (EDR) capabilities to identify ransomware activity early.
-
Microsoft Threat Intelligence continues to observe Sapphire Sleet refining their macOS intrusion tactics, following the same previously documented core attack chain, but with a new Teams‑themed lure. https://msft.it/6042vYRm6 Along with the lure, the new activity also uses updated infrastructure and component naming while maintaining the same user-driven execution model: tricking users into executing trusted system tools to enable credential theft, persistence, and data exfiltration without exploiting vulnerabilities. We updated our blog to highlight the new Sapphire Sleet campaign, and expanded Microsoft Defender detections and hunting queries to help organizations defend against this new activity.
-
Microsoft Defender Experts is sharing an investigation into the sophisticated social engineering operation known as Contagious Interview, which targets software developers and continues to be prevalent. https://msft.it/6042QmHbg Threat actors target developers to attempt to compromise developer endpoints with access to source code, CI/CD pipelines, and production infrastructure. They pose as recruiters from cryptocurrency trading firms or AI-based solution providers and achieve initial access through a convincingly staged recruitment process that mirrors legitimate interviews but leads to a backdoor. The modular backdoor then enables theft of sensitive information like API tokens, cloud credentials, signing keys, cryptocurrency wallets, and password manager artifacts, and also leads to follow-on malicious activity and other payloads. Organizations can defend against this threat by monitoring developer endpoints and build tools, and by hunting for suspicious repository activity and dependency execution patterns. Read the latest Microsoft Defender Experts blog to get the full attack chain analysis, as well as protection, detection, and hunting guidance:
-
Microsoft Defender Experts’ analysis of MacSync Stealer, a macOS-focused infostealer that relies on constantly changing infrastructure for payload delivery, C2, and exfiltration, demonstrates that malicious domains rotate quickly, but attacker behavior often remains consistent. https://msft.it/6045azMxZ By correlating recurring endpoint and network behaviors, including execution patterns, request characteristics, staging behavior, and upload methods, Microsoft Defender Experts uncovered related domains and identified durable detection and hunting pivots. Read our latest blog to learn how to hunt for MacSync Stealer beyond static indicators of compromise (IOCs), and get detection, mitigation, and hunting guidance to help investigate and respond to this threat.
-
Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications, negotiations, and data leak operations. https://msft.it/6047aGqgU DeadLock's recovery ecosystem combines a messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process, allowing DeadLock operators to recover from some disruption efforts while maintaining continuity for victims. As defenders, law enforcement, and industry partners increase pressure on cybercriminal ecosystems, threat actors are being forced to adapt their operations and invest in new ways to maintain resilience. The ransomware employs double extortion tactics and has impacted organizations across multiple sectors and global regions. Get detections, mitigation guidance, and deeper insights into DeadLock's infrastructure, recovery ecosystem, and encryptor design from this Microsoft Threat Intelligence blog post.
-
A single intrusion exposed parallel activity from two unrelated threat actors operating at the same time, blending tactics, obscuring signals, and enabling sustained access while masking the full scope of the compromise. Microsoft Incident Response found activity associated with Storm-2603, including reconnaissance targeting on-premises SharePoint servers, persistence through legitimate tools, and multiple remote access channels. Investigators also uncovered a second threat actor whose use of DLL sideloading and custom backdoors complicated attribution and detection. The case highlights how overlapping intrusion activity can mask the full scope of an attack and why connected telemetry, coordinated response, and operational preparedness remain critical for defenders. Read the full cyberattack series report to learn more: https://msft.it/6049vqXbv
Microsoft makes a valuable case for following attacker behavior across changing ransomware names. In OT, the next question is what defenders can safely do when they detect that behavior. An unusual remote session or credential path may call for immediate containment, but disconnecting a system without operational context can disrupt the service it protects. I would pair each high-confidence detection with a rehearsed decision path: who verifies the affected process, which connections can be isolated, and what local operating mode is available? That turns earlier detection into a safer response.