Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Storm-2570 demonstrates that modern ransomware threat actors are not tightly coupled to a single ransomware strain — they fluidly shift between RaaS platforms like Qilin, DragonForce, Anubis, and BERT while maintaining consistent post-compromise behaviors. Organizations that rely solely on signature- or payload-based detection will repeatedly miss the same attacker because the malware changes but the tradecraft does not. This matters because the affiliate model decouples the criminal infrastructure from the attack execution, making attribution and disruption far harder. Defenders must pivot to behavioral detection — focusing on attacker TTPs such as lateral movement patterns, credential harvesting techniques, and persistence mechanisms — rather than waiting to recognize a specific ransomware binary.