Storm-0270

Storm-0270 is Microsoft's formal designation for the Iranian IRGC-linked ransomware subgroup previously tracked as DEV-0270, operating within the broader Nemesis Kitten cluster. The group gained notoriety for using Windows BitLocker Drive Encryption as a ransomware tool in attacks against US organizations in 2022, combined with data theft and extortion. Storm-0270's operations straddle the line between financially motivated ransomware and state-directed disruption, reflecting the Iranian practice of using cyber criminal-style activity to maintain plausible deniability while advancing national objectives.