The short answer: Storm-2570 is a threat actor whose intrusions Microsoft has linked to the Qilin, DragonForce, Anubis and BERT ransomware strains. Rather than waiting for encrypted file extensions to appear, organisations can look for unplanned remote management tools, access to Active Directory, changes to security controls, widespread use of PsExec and outbound data transfers.
On 24 September 2026, Microsoft Threat Intelligence published an analysis of Storm-2570, a threat actor it has tracked since April 2025. Although the ransomware deployed varied between the investigated intrusions, the tools and techniques used inside the compromised networks remained consistent. Microsoft observed Qilin, DragonForce, Anubis and BERT. These were therefore not four names for a single ransomware strain, but multiple deployments with common characteristics preceding data encryption. (Microsoft Threat Intelligence, 24 September 2026)
The sequence of events matters to businesses. The ransom demand and encrypted file extensions only appear when the damage is done. A new remote management service, the use of ntdsutil, changes to Defender settings or PsExec run against a list of computers may become visible earlier.
What happens before files are encrypted
Storm-2570 used legitimate remote management tools including Atera, MeshAgent, ScreenConnect, Splashtop, Remotely_Agent and NinjaRMM. The name of a program alone is not evidence of compromise. Internal administrators or contracted IT providers may legitimately use the same tools.
An installation is suspicious if it has no known owner, bypasses the approved process or appears on devices where the tool should not be present. Microsoft also described renamed variants of MeshAgent whose names referred to the compromised organisation. Searching by filename alone is therefore not enough.
| Intrusion stage | What Microsoft observed | What the organisation should verify |
|---|---|---|
| Remote control | Atera, MeshAgent, ScreenConnect, Splashtop, Remotely_Agent, NinjaRMM | New services and agents without an approved owner |
| Network reconnaissance | NetScan, Nmap and other tools for discovering devices and services | Scanning of multiple addresses from a workstation that does not normally perform scans |
| Account access | ntdsutil, Mimikatz, LaZagne, pypykatz | Unplanned activity involving Active Directory and NTDS.dit |
| Weakening security controls | Defender monitoring disabled, new exclusions | Changes to security policies outside managed administration |
| Lateral movement | PsExec, Impacket, NetExec, scripts for RDP | Large-scale remote execution across workstations and servers |
| Data theft | Rclone, s5cmd | New cloud destinations and unusual outbound transfers |
Microsoft observed the use of ntdsutil to obtain data from Active Directory, changes to Microsoft Defender including an exclusion for C:\PerfLogs, and PsExec processing a list of devices stored in @ip.txt. Rclone and s5cmd were also used to transfer data outside the organisation. (Microsoft Threat Intelligence, 24 September 2026)
When not to intervene blindly and how we can help
Simply uninstalling a suspicious program may not end the incident. It could also destroy some of the evidence needed to determine the extent of the compromise. Stop attempting to handle the incident yourself, particularly if:
- an unknown RMM agent has appeared on a domain controller, server or administrator’s workstation,
- changes to Defender, use of
ntdsutilor access toNTDS.ditoccurred alongside the new service, - PsExec was run against multiple devices or Rclone or s5cmd transferred a large volume of data to an unknown destination.
As part of our IT security services for businesses, we follow three steps:
- Triage and containment: we record the time, device, account, service and network connections, then recommend how to isolate the affected systems safely.
- Scoping the incident: we compare services, processes, accounts and logs across workstations and servers and investigate possible credential theft.
- Remediation: we prepare a specific procedure for removing unauthorised remote access, changing affected passwords, restoring security policies and checking backups.
If encryption has already occurred, do not make hasty changes to the compromised systems. The article Ransomware in a business: the first 24 hours summarises the practical order of response steps.
Does this affect small businesses in the Czech Republic?
Microsoft describes intrusions affecting organisations in the United States, Canada, the United Kingdom, Spain, the Netherlands and Puerto Rico. The sectors affected include healthcare, education, government, finance, energy, retail, IT, manufacturing and transport. According to both Microsoft and the Forensix Intelligence summary, the initial access method remains unconfirmed. (Microsoft Threat Intelligence, 24 September 2026; Forensix Intelligence, 26 September 2026)
These two sources do not provide evidence that Storm-2570 compromised a Czech business. The checks, however, do not depend on the country or the ransomware brand. Even a small business needs to know who is allowed to install remote management software, which devices may run it and how to detect a change.
What to check first
Start with a list of approved remote access tools. For each one, record:
- the program name and service operator,
- the responsible person within the organisation,
- the supplier that uses it,
- the devices on which it is permitted to run,
- the accounts and method of multi-factor authentication,
- the installation date and reason.
Then compare this list with the services and processes actually installed. If the organisation has approved one specific MeshAgent, any parallel installation of Atera, ScreenConnect or Splashtop needs a documented owner and purpose. MeshAgent is not ransomware in itself; warning signs include an unknown origin, renaming or deployment outside the approved scope.
Monitoring should generate alerts for at least:
- the installation of a new remote management application or system service;
- Microsoft Defender protection being disabled or a new exclusion being created;
- unplanned use of
ntdsutiland access toNTDS.dit; - PsExec being run against a large number of workstations or servers;
- Rclone or s5cmd being launched alongside unusual outbound data transfers.
Do not rely on filenames alone. Monitor the creation of new services, the software publisher and signature, the account used for installation, target devices and network behaviour. The article IT monitoring: what a small business should watch explains what this type of monitoring should cover.
If you find an unauthorised RMM tool
First record the device, service name, program path, installation time, running processes, connected addresses and the account under which the service is running. Only then should you decide whether to isolate the device or uninstall the tool. Disabling a single agent does not address stolen credentials or any additional access the attacker may have established.
Microsoft recommends changing the passwords of accounts used to install an unauthorised RMM tool. If the agent was installed under a system account, Microsoft says further investigation may be warranted. It also recommends multi-factor authentication for approved remote management systems, protecting security settings against unauthorised changes and restricting movement between devices according to the principle of least privilege. (Microsoft Threat Intelligence, 24 September 2026)
Review administrator accounts as well. There should be a clear and regularly reviewed record of who can manage workstations, servers, Active Directory and backups. The audit of access rights within a business provides a practical procedure.
What this case does not prove
The published analysis does not confirm how Storm-2570 initially gained access to the networks. It therefore cannot support the conclusion that phishing, an unpatched vulnerability or a stolen password caused every intrusion described.
Likewise, the presence of MeshAgent, Atera or ScreenConnect does not automatically indicate an attack. What matters is whether the tool matches the organisation’s approved inventory, has a known owner and was deployed through an approved process.
The main lesson is not to search for a single ransomware brand. Organisations need to detect deviations: new remote access, unusual interaction with Active Directory, weakened security controls, large-scale lateral movement between computers or outbound data transfers. These changes may become visible before encrypted files and a ransom demand appear.
Where to find us
ITHOPE is a company based in Brno, Czechia: we do data recovery from disks, RAID and NAS, PC and laptop service and IT for business, all in our own lab at Viniční 3587/216, 615 00 Brno.
Phone +420 775 556 063 (24/7 line). You can bring the device in person, or send it by courier (Zásilkovna, PPL).