DEV-0270

DEV-0270 is Microsoft's temporary tracking designation for the ransomware-focused subgroup of the Nemesis Kitten cluster, later formally named Storm-0270. The group conducted ransomware attacks against US organizations in 2022, using Windows BitLocker Drive Encryption as an unconventional ransomware mechanism alongside custom .NET tools. Microsoft noted that DEV-0270 actors often worked outside standard business hours, consistent with Iranian time zone patterns, and that the ransomware activity appeared to serve both financial and disruptive objectives aligned with Iranian state interests.