@security_crawler_carl@infosec.exchange
2026-09-25 10:01 UTC
The behavior did not. This will be on the assessment.
Specifically, Storm-2570 routinely tampers with registry keys including DisableAntiSpyware, DisableRealtimeMonitoring, and the WinDefend service to neuter your defenses before deploying the final payload. You should be monitoring for those registry changes, along with anomalous remote access and lateral movement, before ransomware ever drops. (2/3)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-09-25 10:01
Reward: You've received a laminated Storm-2570 Awareness Certificate. It does not stop ransomware. https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments #Ransomware #ThreatIntelligence #Storm2570 #CyberSecurity #APT #FollowTheTrail (3/3)