Loading story…
Rhysida ransomware operators have leveraged Microsoft's trusted signing system to deliver the OysterLoader malware, bypassing traditional security defenses. The attackers distributed the malware through malicious advertisements, including those targeting Microsoft Teams users, exploiting the trust associated with Microsoft's digital certificates to evade detection. This technique allowed the threat actors to deploy their payloads with a higher likelihood of success, as security solutions often treat signed binaries as legitimate.
The campaign involved the use of fake search ads to lure victims and facilitate the download of the malicious loader. By abusing the Microsoft trusted signing process, the attackers were able to slip their malware past endpoint protections, increasing the risk of successful ransomware deployment. Security researchers have highlighted the sophistication of this approach and the need for organizations to scrutinize even digitally signed files, as threat actors continue to find ways to exploit trusted mechanisms for malicious purposes.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that Rhysida or an associated supplier was using Microsoft's Trusted Signing service to sign malicious binaries, helping them appear legitimate and evade security controls. The campaign also used packing and obfuscation before signing to further reduce detection.
In a current campaign, the Rhysida ransomware operation used fake search advertisements on Microsoft Bing to redirect users to spoofed download pages for software such as Microsoft Teams, PuTTY, and Zoom. Victims who downloaded the files received the OysterLoader malware, which can establish persistence and fetch additional payloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecsoonline.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft took decisive action to disrupt a sophisticated ransomware campaign orchestrated by the Vanilla Tempest threat group, also known as VICE SPIDER and Vice Society. The attackers exploited over 200 stolen or misused digital certificates to sign malicious Microsoft Teams installers, making their malware appear legitimate to both users and security software. This campaign, active in late September and early October, targeted users searching for Microsoft Teams updates by leveraging search engine optimization (SEO) poisoning and malvertising. Victims were lured to deceptive domains such as teams-download[.]buzz, teams-install[.]run, and teams-download[.]top, which closely mimicked official Microsoft Teams download sites. Unsuspecting users who downloaded and executed the fake MSTeamsSetup.exe files inadvertently installed a multi-stage payload. The initial loader deployed the Oyster backdoor, a versatile malware tool that Vanilla Tempest has used since June 2025. Once installed, Oyster provided the attackers with remote access, enabling them to steal files, execute arbitrary commands, and deploy additional malicious payloads. The campaign’s technical sophistication was heightened by the use of certificates from reputable providers like Trusted Signing, SSL.com, DigiCert, and GlobalSign, which were fraudulently used to sign the malware. Microsoft’s response involved revoking all compromised certificates, effectively neutralizing the attackers’ ability to distribute signed malware and disrupting ongoing infections. The group’s primary objective was financial gain through data exfiltration and ransomware deployment, with Rhysida ransomware being their recent tool of choice. Previous campaigns by Vanilla Tempest have also used ransomware strains such as BlackCat, Quantum Locker, and Zeppelin, but the current focus has been on Rhysida, particularly targeting sectors like healthcare, education, and manufacturing. The attackers’ use of malvertising and SEO poisoning demonstrates an evolving threat landscape where legitimate-looking software is weaponized to bypass traditional defenses. Microsoft’s intervention not only halted the immediate threat but also highlighted the importance of certificate management and vigilance against supply chain attacks. Security researchers emphasized the need for organizations to verify software sources and monitor for unusual certificate usage. The incident underscores the persistent risk posed by financially motivated ransomware groups and the necessity for coordinated industry responses to disrupt their operations. Organizations are advised to educate users about the dangers of downloading software from unofficial sources and to implement robust endpoint protection measures. The campaign’s exposure and Microsoft’s swift action serve as a warning to both defenders and attackers about the critical role of digital trust in modern cyber operations. This event also illustrates the increasing use of backdoors like Oyster in ransomware campaigns, enabling deeper and more persistent access to victim networks. The disruption of this campaign is a significant blow to Vanilla Tempest’s operations and a reminder of the ongoing arms race between threat actors and defenders.
Jun 29, 2026
Attackers have launched a sophisticated malvertising and SEO poisoning campaign to distribute the Oyster backdoor by promoting fake Microsoft Teams installers. The campaign leverages search engine advertisements and manipulated search results for queries like "Teams download," redirecting unsuspecting users to a fraudulent website, teams-install[.]top, which closely mimics the legitimate Microsoft Teams download page. Upon visiting this site, users are prompted to download an installer named "MSTeamsSetup.exe," a filename identical to the official Microsoft Teams installer, increasing the likelihood of deception. The installer is code-signed with certificates from entities such as "4th State Oy" and "NRM NETWORK RISK MANAGEMENT INC," lending further legitimacy to the malicious file. When executed, the installer drops a malicious DLL, CaptureService.dll, into the %APPDATA%\Roaming directory and establishes persistence by creating a scheduled task named "CaptureService" that runs every 11 minutes. This ensures the Oyster backdoor remains active even after system reboots. Oyster, also known as CleanUpLoader and Broomstick, is a commodity backdoor first observed in mid-2023 and has been linked to multiple campaigns, including those supporting ransomware operations like Rhysida. The malware provides attackers with remote access, command execution capabilities, and the ability to deploy additional payloads or exfiltrate files. The campaign's use of SEO poisoning and malvertising mirrors previous tactics used to distribute Oyster via fake installers for other popular IT tools such as PuTTY and WinSCP. Security researchers from Blackpoint SOC identified and analyzed the campaign, highlighting the ongoing abuse of user trust in search results and well-known brands to facilitate initial access to corporate networks. The malicious activity underscores the persistent threat posed by commodity backdoors distributed through deceptive online advertising and the importance of verifying software sources. The campaign does not spoof Microsoft's actual domain but relies on visual mimicry and legitimate-seeming code signatures to bypass user suspicion. The deployment of the Oyster backdoor through this method enables attackers to establish a foothold in targeted environments, potentially leading to further compromise or ransomware deployment. Organizations are advised to educate users about the risks of downloading software from unofficial sources and to implement technical controls to block access to known malicious domains. The incident demonstrates the evolving tactics of threat actors in leveraging trusted brands and digital advertising infrastructure to propagate malware. Security teams should monitor for indicators of compromise related to Oyster and similar backdoors, particularly those delivered via malvertising. The campaign's discovery highlights the need for vigilance in both user behavior and technical defenses against social engineering and software supply chain threats.
Jun 29, 2026
**OysterLoader** (aka **Broomstick** / **CleanUp**) is a C++ multi-stage loader/downloader that uses layered obfuscation and anti-analysis to evade detection and deliver follow-on payloads, and has been repeatedly tied to intrusion chains that culminate in **Rhysida ransomware**. The loader is primarily distributed via **fake websites impersonating legitimate software** (commonly IT/admin tools such as *PuTTy*, *WinSCP*, and *Google Authenticator*, as well as AI-themed tools), where victims are lured into downloading **malicious `MSI` installers** that are often **digitally signed** to appear trustworthy. Reporting attributes OysterLoader’s early public identification to Rapid7 (June 2024) and notes ongoing evolution in its codebase and tradecraft, including changes to obfuscation and command-and-control behavior. Technical analysis describes a **four-stage infection chain**: (1) a **TextShell** packer/obfuscator, (2) **custom shellcode** execution, (3) an intermediate **DLL downloader**, and (4) the **OysterLoader core**. Observed capabilities include **dynamic API resolution** (custom hashing), **API hammering**, and **timing-based sandbox detection**, alongside a **two-tier C2 architecture** separating initial delivery infrastructure from final C2 used for victim interaction. While primarily associated with Rhysida operations (with reporting also linking Rhysida to the **WIZARD SPIDER** ecosystem), OysterLoader has also been observed delivering **commodity malware** such as **Vidar** infostealer; additional reporting indicates it can be distributed via **Gootloader**, and it remains unclear whether OysterLoader is proprietary to a specific actor set or offered more broadly (e.g., as a private MaaS-style capability).
Jun 29, 2026