Microsoft Disrupts Fox Tempest Malware-Signing Service, Revokes Over 1,000 Certificates
Summary
Microsoft says it disrupted Fox Tempest’s malware-signing service, seized signspace[.]cloud, took related infrastructure offline, and revoked over 1,000 certificates used to make malware appear legitimate.
Key points
- Microsoft says Fox Tempest abused Artifact Signing to create more than 1,000 short-lived code-signing certificates and hundreds of Azure tenants and subscriptions.
- Microsoft seized signspace[.]cloud, took hundreds of related virtual machines offline, and blocked access to the platform.
- The service let customers upload malicious files to be signed, helping them impersonate software such as Microsoft Teams, AnyDesk, PuTTY, and Webex.
- Microsoft linked the signed malware to campaigns involving Oyster, Lumma Stealer, and ransomware operations including Rhysida, Akira, INC, Qilin, and BlackByte.
- Microsoft’s complaint describes falsely named Teams installers delivering Oyster malware that could ultimately deploy Rhysida ransomware; the signing certificate initially made the malware appear legitimate to Windows.
- Microsoft says its Digital Crimes Unit and industry partners disrupted the operation in May 2026 and that the company filed a legal action targeting it.
Article Details
- Event Type
- Disruption of a malware-signing-as-a-service operation that abused Microsoft Artifact Signing to create fraudulent code-signing certificates.
- Impact
- Microsoft says it seized the signspace[.]cloud domain, took hundreds of virtual machines offline, blocked access to hosting infrastructure, and revoked more than 1,000 certificates attributed to Fox Tempest. The service enabled malware to appear signed and legitimate, and Microsoft linked its use to multiple malware and ransomware campaigns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | signspace[.]cloud | Microsoft says Fox Tempest operated its malware-signing service through this domain; Microsoft seized it as part of the disruption. |
Threat Actors
AkiraMicrosoft linked the operation to the Akira ransomware operation.BlackByteMicrosoft linked the operation to the BlackByte ransomware operation.Fox TempestMicrosoft identifies Fox Tempest as the financially motivated operator of the malware-signing-as-a-service operation, which created fraudulent code-signing certificates and supported criminal malware use.INCMicrosoft linked the operation to INC ransomware activity; the article also describes Vanilla Tempest as consisting of INC Ransomware members.QilinMicrosoft linked the operation to the Qilin ransomware operation.RhysidaMicrosoft linked the operation to Rhysida ransomware activity; its complaint describes a chain in which signed Oyster malware ultimately deployed Rhysida ransomware.Storm-0249Microsoft says Storm-0249 used malware signed through the operation in attacks.STORM-0501Microsoft says Storm-0501 used malware signed through the operation in attacks.Storm-2561Microsoft says Storm-2561 used malware signed through the operation in attacks.Vanilla TempestMicrosoft says Vanilla Tempest used the service to distribute malware and ransomware, and named the ransomware operation as a co-conspirator in its legal action.
Malware
AkiraThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.BlackByteThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.INC ransomwareThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.Lumma StealerThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.OysterThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.QilinThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.RhysidaThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.VidarThe campaign was tied to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte, and Microsoft seized the signspace[.]cloud domain and revoked over 1,000 certificates.
Vendors
CloudzyMicrosoft also detailed how Fox Tempest evolved its operation earlier this year by providing customers with pre-configured virtual machines hosted through Cloudzy infrastructure.MicrosoftMicrosoft disrupted a malware-signing-as-a-service operation run by Fox Tempest, which abused Artifact Signing to produce fraudulent code-signing certificates that helped ransomware gangs and other criminals make
Products
AnyDeskThe operation helped signed malware masquerade as trusted software like Microsoft Teams and AnyDesk.Azure Artifact SigningAzure Artifact Signing (previously Trusted Signing) is a cloud-based service launched by Microsoft in 2024 that allows developers to easily have their programs signed by Microsoft.Microsoft TeamsThe operation helped signed malware masquerade as trusted software like Microsoft Teams and AnyDesk.Microsoft Windows“Because the Oyster malware was signed by a certificate from Microsoft’s Artifact Signing service, the Windows operating system initially recognized the malware as legitimate software, when it would otherwise be flaggedPuTTYThese signed malware files were then used by threat actors to impersonate legitimate software such as Microsoft Teams, AnyDesk, PuTTY, and Webex, and were used to add legitimacy to the downloads.WebExThese signed malware files were then used by threat actors to impersonate legitimate software such as Microsoft Teams, AnyDesk, PuTTY, and Webex, and were used to add legitimacy to the downloads.