Storm-2570 Reuses the Same Tradecraft Across Multiple Deployments

Summary

Storm-2570 is a cross-ecosystem ransomware affiliate operating across multiple Ransomware-as-a-Service (RaaS) platforms, including Qilin and DragonForce. The actor relies on a consistent post-compromise toolkit that includes several Remote Monitoring and Management (RMM) applications and cloud-based exfiltration utilities. Tracking these recurring behaviors instead of focusing only on the final ransomware payload can help defenders identify and disrupt intrusions earlier in the attack chain.

Investigation

Microsoft Threat Intelligence observed Storm-2570 repeatedly using tools such as MeshAgent, Atera, and Splashtop across different ransomware operations. The investigation identified consistent patterns, including renaming binaries to blend into victim environments and using tunneling tools such as Cloudflared to maintain access. The research shows that the actor’s TTPs remain largely unchanged even when the final ransomware family varies.

Mitigation

Defenders should enable tenant-wide tamper protection to prevent attackers from disabling Microsoft Defender and apply least-privilege controls to restrict lateral movement. Microsoft Defender XDR Attack Surface Reduction rules should be used to block credential theft and unauthorized script execution. Organizations should also enforce MFA for approved RMM platforms and monitor endpoints for unauthorized RMM installations.

Response

When Storm-2570 activity is detected, organizations should immediately investigate unapproved RMM services and reset credentials associated with accounts used to deploy them. Enable automatic attack disruption in Microsoft Defender XDR to contain active threats. Conduct targeted hunting for PsExec-based execution, renamed MeshAgent binaries, and other recurring Storm-2570 artifacts to determine the full scope of compromise.

Simulation Execution

• Attack Narrative & Commands: The adversary has established a foothold using MeshAgent. To move laterally to a target workstation, they deploy PsExec to execute commands remotely. To trigger the specific detection rule, the adversary will ensure both the MeshAgent process and the PsExec process are active in the process tree. The goal is to demonstrate that the presence of both binaries in a single session triggers the high severity alert.

• Regression Test Script:

  # Simulation script to trigger the 'Detect MeshAgent with PsExec' rule
  # Note: This script assumes the binaries exist in the current directory for simulation purposes.
  # In a real scenario, these would be located in various paths.
  
  $currentDir = Get-Location
  $meshAgentPath = "$currentDirmeshagent.exe"
  $psexecPath = "$currentDirpsexec.exe"
  
  # Create dummy files if they don't exist to prevent script error, 
  # though in a real test, real binaries would be used.
  if (-not (Test-Path $meshAgentPath)) { New-Item -Path $meshAgentPath -ItemType File }
  if (-not (Test-Path $psexecPath)) { New-Item -Path $psexecPath -ItemType File }
  
  Write-Host "[+] Starting MeshAgent simulation..." -ForegroundColor Cyan
  $meshProcess = Start-Process -FilePath $meshAgentPath -PassThru -WindowStyle Hidden
  
  Write-Host "[+] Starting PsExec simulation..." -ForegroundColor Cyan
  # We use a dummy command to simulate the execution
  Start-Process -FilePath $psexecPath -ArgumentList "\127.0.0.1 -u admin -p password cmd.exe /c echo 'Lateral Movement Simulation'"
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup script to remove dummy files and stop processes
  Stop-Process -Name "meshagent*" -ErrorAction SilentlyContinue
  Remove-Item -Path ".meshagent.exe" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path ".psexec.exe" -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete." -ForegroundColor Yellow