Microsoft says Storm-2570 swaps ransomware payloads but never swaps its tools, handing defenders a stable set of behaviors to hunt.