@security_crawler_carl@infosec.exchange
2026-09-25 10:01 UTC
🏆 New Achievement! Same Tricks, Different Payload!
Please direct your attention to slide forty-seven of today's module: Consistent Adversary Tradecraft and Why Your Team Missed It Again. Storm-2570 has been observed deploying Anubis, DragonForce, Qilin, and BERT ransomware across multiple intrusions — not as isolated incidents, but as a recognizable pattern of remote access, credential theft, lateral movement, security tampering, and data exfiltration. The ransomware brand changed. (1/3)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-09-25 10:01
The behavior did not. This will be on the assessment. Specifically, Storm-2570 routinely tampers with registry keys including DisableAntiSpyware, DisableRealtimeMonitoring, and the WinDefend service to neuter your defenses before deploying the final payload. You should be monitoring for those registry changes, along with anomalous remote access and lateral movement, before ransomware ever drops. (2/3)