Loading story…
Microsoft took decisive action to disrupt a sophisticated ransomware campaign orchestrated by the Vanilla Tempest threat group, also known as VICE SPIDER and Vice Society. The attackers exploited over 200 stolen or misused digital certificates to sign malicious Microsoft Teams installers, making their malware appear legitimate to both users and security software. This campaign, active in late September and early October, targeted users searching for Microsoft Teams updates by leveraging search engine optimization (SEO) poisoning and malvertising. Victims were lured to deceptive domains such as teams-download[.]buzz, teams-install[.]run, and teams-download[.]top, which closely mimicked official Microsoft Teams download sites. Unsuspecting users who downloaded and executed the fake MSTeamsSetup.exe files inadvertently installed a multi-stage payload. The initial loader deployed the Oyster backdoor, a versatile malware tool that Vanilla Tempest has used since June 2025. Once installed, Oyster provided the attackers with remote access, enabling them to steal files, execute arbitrary commands, and deploy additional malicious payloads. The campaign’s technical sophistication was heightened by the use of certificates from reputable providers like Trusted Signing, SSL.com, DigiCert, and GlobalSign, which were fraudulently used to sign the malware. Microsoft’s response involved revoking all compromised certificates, effectively neutralizing the attackers’ ability to distribute signed malware and disrupting ongoing infections. The group’s primary objective was financial gain through data exfiltration and ransomware deployment, with Rhysida ransomware being their recent tool of choice. Previous campaigns by Vanilla Tempest have also used ransomware strains such as BlackCat, Quantum Locker, and Zeppelin, but the current focus has been on Rhysida, particularly targeting sectors like healthcare, education, and manufacturing. The attackers’ use of malvertising and SEO poisoning demonstrates an evolving threat landscape where legitimate-looking software is weaponized to bypass traditional defenses. Microsoft’s intervention not only halted the immediate threat but also highlighted the importance of certificate management and vigilance against supply chain attacks. Security researchers emphasized the need for organizations to verify software sources and monitor for unusual certificate usage. The incident underscores the persistent risk posed by financially motivated ransomware groups and the necessity for coordinated industry responses to disrupt their operations. Organizations are advised to educate users about the dangers of downloading software from unofficial sources and to implement robust endpoint protection measures. The campaign’s exposure and Microsoft’s swift action serve as a warning to both defenders and attackers about the critical role of digital trust in modern cyber operations. This event also illustrates the increasing use of backdoors like Oyster in ransomware campaigns, enabling deeper and more persistent access to victim networks. The disruption of this campaign is a significant blow to Vanilla Tempest’s operations and a reminder of the ongoing arms race between threat actors and defenders.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Following publication of Microsoft's findings, DigiCert and GlobalSign said they had not yet been asked to revoke certificates mentioned in the reporting but would investigate and revoke them if misuse was confirmed. SSL.com had not responded at the time of reporting.
On October 16-17, 2025, Microsoft's disruption of the fake Teams installer campaign and certificate abuse became public through coordinated reporting. The disclosure detailed the infection chain, certificate revocations, and the actor's use of SEO poisoning and lookalike domains.
As part of the disruption, Microsoft updated Microsoft Defender Antivirus and Defender for Endpoint to detect and block the fake installers, Oyster backdoor, Rhysida ransomware, and related behaviors. It also published indicators of compromise and mitigation guidance for defenders.
In early October 2025, Microsoft disrupted the operation by revoking more than 200 code-signing certificates used to make malicious Teams installers and related malware appear legitimate. The revocations targeted certificates abused in Rhysida-linked intrusions attributed to Vanilla Tempest.
Microsoft said it uncovered the activity in late September 2025 after observing several months of fraudulently signed binaries used in attacks. The company attributed the operation to Vanilla Tempest, also tracked as VICE SPIDER/Vice Society.
In late September 2025, Vanilla Tempest pushed a campaign using SEO poisoning, malvertising, and lookalike Microsoft Teams download domains to distribute trojanized MSTeamsSetup.exe files. Executing the fake installer launched a loader that deployed Oyster and enabled eventual Rhysida ransomware attacks and data exfiltration.
Expel reported overlap between the Oyster campaign and Latrodectus malware through a shared Art en Code B.V. certificate used in mid-September 2025. This provided additional technical insight into certificate abuse tied to the campaign ecosystem.
By early September 2025, Vanilla Tempest had begun fraudulently code-signing Oyster backdoors, fake Microsoft Teams installers, and related tooling. Reports say the actor abused Microsoft Trusted Signing as well as certificates from commercial certificate authorities.
Microsoft assessed that the financially motivated threat actor Vanilla Tempest started integrating the Oyster backdoor into its intrusion activity as early as June 2025. Oyster was used as a signed loader/backdoor to enable follow-on access, data theft, and later ransomware deployment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcehelpnetsecurity.com
Open sourcesecurityaffairs.com
Open sourcedarkreading.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have launched a sophisticated malvertising and SEO poisoning campaign to distribute the Oyster backdoor by promoting fake Microsoft Teams installers. The campaign leverages search engine advertisements and manipulated search results for queries like "Teams download," redirecting unsuspecting users to a fraudulent website, teams-install[.]top, which closely mimics the legitimate Microsoft Teams download page. Upon visiting this site, users are prompted to download an installer named "MSTeamsSetup.exe," a filename identical to the official Microsoft Teams installer, increasing the likelihood of deception. The installer is code-signed with certificates from entities such as "4th State Oy" and "NRM NETWORK RISK MANAGEMENT INC," lending further legitimacy to the malicious file. When executed, the installer drops a malicious DLL, CaptureService.dll, into the %APPDATA%\Roaming directory and establishes persistence by creating a scheduled task named "CaptureService" that runs every 11 minutes. This ensures the Oyster backdoor remains active even after system reboots. Oyster, also known as CleanUpLoader and Broomstick, is a commodity backdoor first observed in mid-2023 and has been linked to multiple campaigns, including those supporting ransomware operations like Rhysida. The malware provides attackers with remote access, command execution capabilities, and the ability to deploy additional payloads or exfiltrate files. The campaign's use of SEO poisoning and malvertising mirrors previous tactics used to distribute Oyster via fake installers for other popular IT tools such as PuTTY and WinSCP. Security researchers from Blackpoint SOC identified and analyzed the campaign, highlighting the ongoing abuse of user trust in search results and well-known brands to facilitate initial access to corporate networks. The malicious activity underscores the persistent threat posed by commodity backdoors distributed through deceptive online advertising and the importance of verifying software sources. The campaign does not spoof Microsoft's actual domain but relies on visual mimicry and legitimate-seeming code signatures to bypass user suspicion. The deployment of the Oyster backdoor through this method enables attackers to establish a foothold in targeted environments, potentially leading to further compromise or ransomware deployment. Organizations are advised to educate users about the risks of downloading software from unofficial sources and to implement technical controls to block access to known malicious domains. The incident demonstrates the evolving tactics of threat actors in leveraging trusted brands and digital advertising infrastructure to propagate malware. Security teams should monitor for indicators of compromise related to Oyster and similar backdoors, particularly those delivered via malvertising. The campaign's discovery highlights the need for vigilance in both user behavior and technical defenses against social engineering and software supply chain threats.
Jun 29, 2026
Cybercriminals have launched a widespread campaign targeting users seeking to download Microsoft Teams by distributing fake installers embedded with the Oyster backdoor, also known as Broomstick. Attackers employ a combination of SEO poisoning and malvertising to ensure their malicious download pages appear prominently in search engine results and sponsored ads, increasing the likelihood that unsuspecting users will click on them. Victims who visit these spoofed websites, such as teams-install.top, are tricked into downloading a file named MSTeamsSetup.exe, which is designed to closely mimic the legitimate Teams installer. To further evade detection, the attackers have signed these fake installers with dubious digital certificates issued by companies like 4th State Oy and NRM NETWORK RISK MANAGEMENT INC., making the files appear trustworthy to both users and some security controls. Upon execution, the installer not only launches the real Microsoft Teams application to avoid arousing suspicion but also silently installs the Oyster backdoor in the background. This malware establishes command and control (C2) communications with attacker-controlled servers, such as nickbush24.com and techwisenetwork.com, enabling remote access and persistent control over the compromised system. The Oyster backdoor is highly versatile, allowing threat actors to gather system information, exfiltrate data, and potentially deploy additional payloads. Security researchers from Blackpoint Cyber have been actively monitoring this campaign and have highlighted the sophistication of the attackers' methods, including the use of legitimate-looking certificates and multi-stage delivery techniques. The campaign underscores the growing threat of supply chain and software impersonation attacks, particularly as users increasingly rely on web searches to obtain software. Organizations are advised to educate users about the risks of downloading software from unofficial sources, implement robust endpoint protection, and monitor for suspicious outbound connections indicative of C2 activity. The incident also highlights the importance of verifying digital signatures and scrutinizing the provenance of software installers, as attackers continue to refine their techniques to bypass traditional security measures. This campaign represents a significant escalation in the abuse of trusted brand names and software distribution channels to propagate advanced malware, posing risks to both individual users and enterprise environments. The use of malvertising and SEO manipulation demonstrates the attackers' adaptability and their focus on maximizing the reach and impact of their operations. Security teams should remain vigilant for similar tactics targeting other widely used collaboration and productivity tools.
Jun 29, 2026
Microsoft said it disrupted **Fox Tempest**, a malware-signing-as-a-service operation that helped cybercriminals make malicious software appear legitimate by abusing code-signing tools including Microsoft Artifact Signing. The company unsealed a case in the U.S. District Court for the Southern District of New York, alleging the group used fabricated identities and impersonated organizations to create hundreds of fraudulent Microsoft accounts and obtain code-signing credentials at scale, generating millions in proceeds. Microsoft linked the service to infections on thousands of machines and to malware and ransomware including **Oyster**, **Lumma Stealer**, **Vidar**, **Rhysida**, and affiliates tied to **INC**, **Qilin**, and **Akira**. As part of the disruption, Microsoft seized the `signspace[.]cloud` website, took hundreds of virtual machines offline, and blocked access to another site hosting the underlying code. The lawsuit also names **Vanilla Tempest** as a co-conspirator, and Microsoft said the service had supported attacks across healthcare, education, government, and financial services in countries including the United States, France, India, and China. According to Microsoft, Fox Tempest adapted after earlier defensive actions by shifting to third-party-hosted virtual machines and trying to move customers to another signing service, underscoring how commercialized code-signing services are being used to improve ransomware delivery and evade detection.
Jun 29, 2026