cyber.hendryadrian.com
Security News · cyberscoop.com

Microsoft Disrupts Fox Tempest Malware-Signing Service

· Original article ↗

Summary

Microsoft says it seized Fox Tempest infrastructure and removed more than 1,000 accounts and subscriptions. The service sold code-signing certificates that helped malware appear trusted and supported ransomware and other cybercrime operations.

Key points

  • Microsoft said a court order enabled it to dismantle infrastructure used by Fox Tempest, which it tracks as a financially motivated threat group.
  • Fox Tempest allegedly sold more than 1,000 code-signing certificates, charging customers up to $9,500 to make malicious software appear trusted.
  • Microsoft said Fox Tempest abused its Artifact Signing system by fabricating identities and impersonating legitimate organizations.
  • Microsoft linked the service to ransomware groups including Rhysida, Vanilla Tempest, Storm-0501, Storm-2561 and Storm-0249, and to affiliates of INC, Qilin and Akira.
  • The service was linked to dozens of malware families, including Oyster, Lumma Stealer, MuddyWater and Vidar; certificates were used in campaigns involving SEO poisoning and malicious advertising.
  • Microsoft said the operation affected healthcare, education, government and financial services, with organizations and people in the United States, France, India and China among the most targeted.
  • Microsoft said it removed more than 1,000 accounts and subscriptions, took hundreds of virtual machines offline and seized the group's website; the company cautioned that the disruption may prompt attackers to use alternatives.

Article Details

Event Type
Microsoft disruption and infrastructure seizure of Fox Tempest, a cybercrime service selling fraudulent code-signing certificates.
Impact
Microsoft said Fox Tempest sold more than 1,000 certificates used to make malicious software appear trusted and bypass security defenses. The service was linked to malware deployments and ransomware activity affecting healthcare, education, government, and financial services organizations worldwide, with organizations and people in the United States, France, India, and China among the most heavily targeted. Microsoft said it removed or deleted more than 1,000 accounts and subscriptions, seized the service’s website, took hundreds of virtual machines offline, and blocked access to a site hosting the underlying code.

MITRE ATT&CK

T1553.002 · Code SigningFox Tempest sold certificates used to sign malicious software so it would appear trusted and bypass security defenses.

People

Maurice MasonPrincipal cybercrime investigator at Microsoft’s Digital Crimes Unit who led the investigation into Fox Tempest.Steven MasadaAssistant general counsel at Microsoft Digital Crimes Unit; described Fox Tempest’s operation and Microsoft’s disruption during a media briefing.

Threat Actors

AkiraMicrosoft said Fox Tempest was linked to ransomware affiliates for Akira.Fox TempestMicrosoft tracks this financially motivated cybercrime group, which operated a service selling code-signing certificates to cybercriminals and was disrupted by Microsoft.INCMicrosoft said Fox Tempest was linked to ransomware affiliates for INC.QilinMicrosoft said Fox Tempest was linked to ransomware affiliates for Qilin.RhysidaMicrosoft identified Rhysida as a ransomware group provided with Fox Tempest’s malware-signing service.Storm-0249Microsoft identified Storm-0249 as a ransomware group provided with Fox Tempest’s malware-signing service.STORM-0501Microsoft identified Storm-0501 as a ransomware group provided with Fox Tempest’s malware-signing service.Storm-2561Microsoft identified Storm-2561 as a ransomware group provided with Fox Tempest’s malware-signing service.Vanilla TempestMicrosoft identified Vanilla Tempest as a ransomware group provided with Fox Tempest’s malware-signing service.

Malware

Lumma Stealercode signed, was directly linked to the deployment of dozens of malware families, including Oyster, Lumma Stealer, MuddyWater and Vidar, he added.MuddyWater#FoxTempestOyster#FoxTempestVidar#FoxTempest

Vendors

MicrosoftMicrosoft disrupted Fox Tempest, a cybercrime service that sold more than 1,000 code-signing certificates to help malicious software appear trusted and bypass security defenses.

Countries

Chinasectors, and most heavily targeted organizations and people in the United States, France, India and China.Franceand financial services sectors, and most heavily targeted organizations and people in the United States, France, India and China.Indiaservices sectors, and most heavily targeted organizations and people in the United States, France, India and China.United Statesgovernment and financial services sectors, and most heavily targeted organizations and people in the United States, France, India and China.

Industries

EducationThe operation had a global impact, resulting in attacks on the healthcare, education, government and financial services sectors, and most heavily targeted organizations and people in the United States, France, India andFinancial ServicesThe operation had a global impact, resulting in attacks on the healthcare, education, government and financial services sectors, and most heavily targeted organizations and people in the United States, France, India andGovernmentThe operation had a global impact, resulting in attacks on the healthcare, education, government and financial services sectors, and most heavily targeted organizations and people in the United States, France, India andHealthcareThe operation had a global impact, resulting in attacks on the healthcare, education, government and financial services sectors, and most heavily targeted organizations and people in the United States, France, India and

Related Articles