security: Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Microsoft Security Blog
2026-09-24
Microsoft says Storm-2570 reuses the same post-compromise tools and techniques across multiple ransomware deployments, including Qilin, DragonForce, Anubis, and BERT. The post outlines guidance for defenders to detect and disrupt the activity before ransomware is deployed.