Threat Intelligence Analyst: 2026-09-25

1. Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

   Microsoft Threat Intelligence, 2026-09-24. Read, 17 min.

   Microsoft Threat Intelligence has observed Storm-2570, a ransomware affiliate it has tracked since April 2025, using consistent post-compromise tools and techniques, infrastructure overlaps, and the same remote access and cloud exfiltration tooling across deployments of Qilin, DragonForce, Anubis, and BERT ransomware. Microsoft argues that tracking ransomware attacks by payload alone can obscure the affiliates carrying out the intrusions, and the post includes detections and hunting queries.

   Why it matters for this role: Microsoft's case for tracking Storm-2570 as one affiliate across Qilin, DragonForce, Anubis, and BERT rests on uniform tradecraft and infrastructure overlaps, which argues for attributing by behavior rather than by payload in your own reporting.

2. Introducing CAIRN: Frontier tracking for AI-integrated malware

   Cisco Talos, 2026-09-22. Read, 10 min.

   Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), a research toolkit for hunting, classifying, and tracking AI-integrated malware. It works from artifacts attackers leave in their tooling, such as prompt templates, provider endpoints, API keys, and jailbreak terms, which Talos says can be extracted, related, and classified without touching the underlying binary.

   Why it matters for this role: CAIRN's explorer graphs samples by submitter, import hash, domain, and AI provider, giving you a structured way to relate AI-integrated malware to families, infrastructure, and actors.

Threat Intelligence Analyst