cyber.hendryadrian.com
Security News · securityweek.com

Microsoft Disrupts Fox Tempest Malware-Signing Service

· Original article ↗

Summary

Microsoft says it disrupted Fox Tempest’s malware-signing service, revoked over 1,000 attributed certificates, seized core infrastructure, and removed fraudulent accounts. The service reportedly supported ransomware and other malware distribution.

Key points

  • Microsoft says Fox Tempest operated a malware-signing-as-a-service operation abusing Microsoft Artifact Signing to create short-lived certificates for malware disguised as legitimate software.
  • Microsoft reports that Fox Tempest created over 1,000 certificates and hundreds of Azure tenants and subscriptions; Microsoft revoked over 1,000 certificates attributed to the actor.
  • Microsoft says the service was used by ransomware groups including Vanilla Tempest, Rhysida, Qilin, and Akira.
  • The service also reportedly supported distribution of Lumma Stealer, Oyster, and Vidar.
  • Microsoft says it seized core infrastructure, removed fraudulent accounts, strengthened verification processes, and filed a lawsuit targeting Fox Tempest and Vanilla Tempest.

Article Details

Event Type
Disruption of a malware-signing-as-a-service operation used to distribute ransomware and other malware.
Impact
Microsoft says Fox Tempest created over 1,000 code-signing certificates and hundreds of Azure tenants and subscriptions. Microsoft revoked over 1,000 certificates, seized core infrastructure, removed fraudulent accounts, and strengthened verification processes. The service was used to distribute ransomware and malware affecting organizations globally, including in healthcare, education, government, and financial services.

Threat Actors

Fox TempestMicrosoft says Fox Tempest operated the malware-signing-as-a-service that generated certificates used to sign malware disguised as legitimate software, and attributes over 1,000 certificates and hundreds of Azure tenants and subscriptions to its operations.Vanilla TempestMicrosoft identified Vanilla Tempest as a ransomware group that used the malware-signing service and says it targeted the group in October 2025; the company also filed a lawsuit targeting it.

Malware

AkiraThe MSaaS has been used to deliver ransomware such as Rhysida, Inc, Qilin, and Akira.INC ransomwareThe MSaaS has been used to deliver ransomware such as Rhysida, Inc, Qilin, and Akira.Lumma StealerIn addition to ransomware, Fox Tempest has aided the distribution of malware families such as Lumma Stealer, Oyster, and Vidar.OysterIn addition to ransomware, Fox Tempest has aided the distribution of malware families such as Lumma Stealer, Oyster, and Vidar.QilinThe MSaaS has been used to deliver ransomware such as Rhysida, Inc, Qilin, and Akira.RhysidaThe MSaaS has been used to deliver ransomware such as Rhysida, Inc, Qilin, and Akira.VidarIn addition to ransomware, Fox Tempest has aided the distribution of malware families such as Lumma Stealer, Oyster, and Vidar.

Vendors

MicrosoftMicrosoft announced on Tuesday that it has disrupted a cybercrime service that has been helping threat actors distribute ransomware and other malware.

Products

Azure“Fox Tempest has created over a thousand certificates and established hundreds of Azure tenants and subscriptions to support its operations.Microsoft Artifact SigningAccording to the tech giant, a threat actor it has named Fox Tempest has been running a malware-signing-as-a-service (MSaaS) that abuses Microsoft Artifact Signing to generate short-lived code-signing certificates.

Countries

Chinaimpacting organizations globally including, but not limited to the United States, France, India, and China,” Microsoft said.Franceand financial services, impacting organizations globally including, but not limited to the United States, France, India, and China,” Microsoft said.Indiaservices, impacting organizations globally including, but not limited to the United States, France, India, and China,” Microsoft said.United Statesand financial services, impacting organizations globally including, but not limited to the United States, France, India, and China,” Microsoft said.

Industries

Educationoperations has resulted in attacks against a broad range of industry sectors, including healthcare, education, government, and financial services, impacting organizations globally including, but not limited to theFinancial Servicesattacks against a broad range of industry sectors, including healthcare, education, government, and financial services, impacting organizations globally including, but not limited to the United States, France, India,Governmenthas resulted in attacks against a broad range of industry sectors, including healthcare, education, government, and financial services, impacting organizations globally including, but not limited to the UnitedHealthcareimpact of these operations has resulted in attacks against a broad range of industry sectors, including healthcare, education, government, and financial services, impacting organizations globally including, but not

Related Articles