Storm-2570 Ransomware Affiliate Tied to Four RaaS Brands

A Single Playbook, Multiple Ransomware Brands

Microsoft Threat Intelligence has been tracking a ransomware affiliate it calls Storm-2570 since April 2025, and the group's behavior is drawing attention for an unusual reason: consistency. Rather than sticking to one ransomware family, Storm-2570 has been observed deploying payloads associated with at least four separate ransomware-as-a-service (RaaS) brands, including Qilin, DragonForce, Anubis, and BERT. What ties these seemingly different attacks together is a repeatable set of post-compromise tools and techniques that Microsoft researchers have identified across deployments, regardless of which ransomware brand ends up encrypting the final payload.

This matters because it reflects how the ransomware ecosystem actually works in 2026. Affiliates like Storm-2570 aren't loyal to a single ransomware operator. They're technicians for hire, breaking into networks using a consistent methodology and then choosing (or being assigned) whichever RaaS brand fits the job. Microsoft has published Defender hunting queries specifically to help security teams spot Storm-2570's fingerprints early, before the ransomware payload itself ever detonates.

Why Affiliates, Not Just Ransomware Brands, Matter

Most ransomware coverage focuses on the final payload: the encryption tool, the ransom note, the leak site. But that's often the last step in a much longer intrusion. Affiliates like Storm-2570 are the ones doing the actual break-in work: gaining initial access, moving laterally, escalating privileges, and disabling defenses before handing off to whichever ransomware brand they're affiliated with that week.

This affiliate model helps explain why ransomware attacks tied to entirely different "brands" can look eerily similar under the hood. It also explains why some of the highest-profile ransomware activity recently traces back to the same exploited infrastructure. Our earlier coverage of ransomware gangs targeting Palo Alto and Fortinet VPN flaws and the CVE-2026-0257 firewall flaw fueling Qilin attacks both illustrate the pattern: internet-facing remote access appliances, VPN gateways and firewalls in particular, remain a favored entry point for affiliates feeding multiple RaaS operations, Qilin among them.

Once inside, affiliates like Storm-2570 have been observed attempting to interfere with endpoint protection, including tampering with security controls like Microsoft Defender, in an effort to operate undetected for longer. That extended dwell time is exactly what lets an intrusion escalate from a single compromised account to a full network-wide ransomware event.

The Bigger Ransomware Picture

Storm-2570 isn't operating in a vacuum. Ransomware activity overall has continued to climb, with recent industry reporting, including Black Kite's 2026 ransomware report tracking over 7,500 victims, showing just how widespread the problem has become. Other RaaS operations covered on this site, from the Rust-based Cicada3301 ransomware to Feral Wolf's exploitation of Confluence servers, show a consistent theme across the ransomware landscape: attackers are increasingly patient, methodical, and focused on exploiting known, often unpatched, vulnerabilities in business-facing software and appliances rather than relying purely on phishing.

What This Means For You

If you run IT for a small or mid-sized business, the Storm-2570 pattern is a reminder that ransomware defense starts well before encryption. VPN and firewall appliances that face the public internet need to be patched promptly and monitored closely, since these are frequently the first foothold an affiliate needs. Multi-factor authentication on remote access and administrative accounts, network segmentation so a single compromised device can't reach everything, and monitoring for attempts to disable or tamper with your endpoint security tools are all practical, high-impact steps.

For individual users and remote workers, the takeaway is more personal but no less important. If you connect to a work network through a VPN, keep that client updated and never delay security patches on the device you use for remote access. Avoid downloading cracked software or unofficial VPN apps, since compromised endpoints are a common way attackers gain the initial access that affiliates like Storm-2570 later build on. A personal VPN can help protect your own traffic on untrusted networks, but it's not a substitute for keeping your devices and credentials secure.

Practical Takeaways

Businesses should audit all internet-facing VPN and firewall appliances for outstanding patches, enforce MFA everywhere remote access is possible, and ensure endpoint protection tools are configured to alert on tampering attempts rather than fail silently. Reviewing backup integrity and testing recovery procedures now, before an incident occurs, remains one of the most effective ways to blunt the impact of any ransomware deployment, regardless of which RaaS brand ends up behind it. Individuals should keep software and VPN clients current, use strong unique passwords with MFA wherever offered, and treat any unexpected security software alerts as worth investigating immediately rather than dismissing them.