Storm-2570 is a cross-ecosystem ransomware affiliate operating across multiple Ransomware-as-a-Service (RaaS) platforms, including Qilin and DragonForce. The actor relies on a consistent post-compromise toolkit that includes several Remote Monitoring and Management (RMM) applications and cloud-based exfiltration utilities. Tracking these recurring behaviors instead of focusing only on the final ransomware payload can help defenders identify and disrupt intrusions earlier in the attack chain.
Microsoft Threat Intelligence observed Storm-2570 repeatedly using tools such as MeshAgent, Atera, and Splashtop across different ransomware operations. The investigation identified consistent patterns, including renaming binaries to blend into victim environments and using tunneling tools such as Cloudflared to maintain access. The research shows that the actor’s TTPs remain largely unchanged even when the final ransomware family varies.
Defenders should enable tenant-wide tamper protection to prevent attackers from disabling Microsoft Defender and apply least-privilege controls to restrict lateral movement. Microsoft Defender XDR Attack Surface Reduction rules should be used to block credential theft and unauthorized script execution. Organizations should also enforce MFA for approved RMM platforms and monitor endpoints for unauthorized RMM installations.
When Storm-2570 activity is detected, organizations should immediately investigate unapproved RMM services and reset credentials associated with accounts used to deploy them. Enable automatic attack disruption in Microsoft Defender XDR to contain active threats. Conduct targeted hunting for PsExec-based execution, renamed MeshAgent binaries, and other recurring Storm-2570 artifacts to determine the full scope of compromise.
Attack Narrative & Commands: The adversary has established a foothold using MeshAgent. To move laterally to a target workstation, they deploy PsExec to execute commands remotely. To trigger the specific detection rule, the adversary will ensure both the MeshAgent process and the PsExec process are active in the process tree. The goal is to demonstrate that the presence of both binaries in a single session triggers the high severity alert.
Attack Narrative & Commands: The adversary has established a foothold using MeshAgent. To move laterally to a target workstation, they deploy PsExec to execute commands remotely. To trigger the specific detection rule, the adversary will ensure both the MeshAgent process and the PsExec process are active in the process tree. The goal is to demonstrate that the presence of both binaries in a single session triggers the high severity alert.
Regression Test Script: # Simulation script to trigger the 'Detect MeshAgent with PsExec' rule # Note: This script assumes the binaries exist in the current directory for simulation purposes. # In a real scenario, these would be located in various paths. $currentDir = Get-Location $meshAgentPath = "$currentDirmeshagent.exe" $psexecPath = "$currentDirpsexec.exe" # Create dummy files if they don't exist to prevent script error, # though in a real test, real binaries would be used. if (-not (Test-Path $meshAgentPath)) { New-Item -Path $meshAgentPath -ItemType File } if (-not (Test-Path $psexecPath)) { New-Item -Path $psexecPath -ItemType File } Write-Host "[+] Starting MeshAgent simulation..." -ForegroundColor Cyan $meshProcess = Start-Process -FilePath $meshAgentPath -PassThru -WindowStyle Hidden Write-Host "[+] Starting PsExec simulation..." -ForegroundColor Cyan # We use a dummy command to simulate the execution Start-Process -FilePath $psexecPath -ArgumentList "\127.0.0.1 -u admin -p password cmd.exe /c echo 'Lateral Movement Simulation'" Write-Host "[+] Simulation complete. Check SIEM for alerts." -ForegroundColor Green
Regression Test Script:
Cleanup Commands: # Cleanup script to remove dummy files and stop processes Stop-Process -Name "meshagent*" -ErrorAction SilentlyContinue Remove-Item -Path ".meshagent.exe" -Force -ErrorAction SilentlyContinue Remove-Item -Path ".psexec.exe" -Force -ErrorAction SilentlyContinue Write-Host "[+] Cleanup complete." -ForegroundColor Yellow
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
