Loading story…
Microsoft said it disrupted Fox Tempest, a malware-signing-as-a-service operation that helped cybercriminals make malicious software appear legitimate by abusing code-signing tools including Microsoft Artifact Signing. The company unsealed a case in the U.S. District Court for the Southern District of New York, alleging the group used fabricated identities and impersonated organizations to create hundreds of fraudulent Microsoft accounts and obtain code-signing credentials at scale, generating millions in proceeds. Microsoft linked the service to infections on thousands of machines and to malware and ransomware including Oyster, Lumma Stealer, Vidar, Rhysida, and affiliates tied to INC, Qilin, and Akira.
As part of the disruption, Microsoft seized the signspace[.]cloud website, took hundreds of virtual machines offline, and blocked access to another site hosting the underlying code. The lawsuit also names Vanilla Tempest as a co-conspirator, and Microsoft said the service had supported attacks across healthcare, education, government, and financial services in countries including the United States, France, India, and China. According to Microsoft, Fox Tempest adapted after earlier defensive actions by shifting to third-party-hosted virtual machines and trying to move customers to another signing service, underscoring how commercialized code-signing services are being used to improve ransomware delivery and evade detection.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft said it is continuing disruption efforts in coordination with Resecurity, Europol EC3, and the FBI, while working to strengthen the broader code-signing ecosystem. The announcement framed Fox Tempest as part of a growing modular cybercrime market for illicit code-signing services.
On 2026-05-19, Microsoft said it revoked more than 1,000 code-signing certificates associated with the Fox Tempest malware-signing service. The revocations were part of the broader disruption that also included seizing the group's website and taking infrastructure offline.
On May 19, 2026, Microsoft announced it had unsealed a case in the U.S. District Court for the Southern District of New York against Fox Tempest and named Vanilla Tempest as a co-conspirator. As part of the disruption, Microsoft seized the signspace[.]cloud website, took hundreds of virtual machines offline, and blocked access to a site hosting the underlying code.
Microsoft filed a civil action against Fox Tempest in the U.S. District Court for the Southern District of New York on May 5, 2026, and obtained a court order on May 8. The legal action enabled subsequent sinkholing, account takedowns, VM disruptions, and repository suspension tied to the operation.
Between February and March 2026, investigators conducted undercover purchases from the Fox Tempest malware-signing service to observe how it operated, gather operational details, and identify cryptocurrency wallets linked to the defendants. The activity helped document the service ahead of Microsoft's legal and disruption actions.
Microsoft said that in February 2026, Fox Tempest adapted to defensive actions by moving to third-party-hosted virtual machines and attempting to migrate customers to another code-signing service. The change indicated the group was responding to pressure on its existing infrastructure and tooling.
After launching, the service was used to sign malware tied to campaigns involving Oyster, Lumma Stealer, Vidar, Rhysida, and other ransomware affiliates and families including INC, Qilin, and Akira. Microsoft said these downstream attacks infected thousands of machines across sectors including healthcare, education, government, and financial services in countries including the United States, France, India, and China.
Microsoft said Fox Tempest began operating in May 2025, offering a service that helped cybercriminals make malware appear legitimate by abusing code-signing tools such as Microsoft Artifact Signing. The operation allegedly used fabricated identities and impersonated organizations to create fraudulent Microsoft accounts and obtain signing credentials at scale.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
20 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcexakep.ru
Open sourcetheregister.com
Open sourceblogs.microsoft.com
Open sourceblogs.microsoft.com
Open sourceaka.ms
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft took decisive action to disrupt a sophisticated ransomware campaign orchestrated by the Vanilla Tempest threat group, also known as VICE SPIDER and Vice Society. The attackers exploited over 200 stolen or misused digital certificates to sign malicious Microsoft Teams installers, making their malware appear legitimate to both users and security software. This campaign, active in late September and early October, targeted users searching for Microsoft Teams updates by leveraging search engine optimization (SEO) poisoning and malvertising. Victims were lured to deceptive domains such as teams-download[.]buzz, teams-install[.]run, and teams-download[.]top, which closely mimicked official Microsoft Teams download sites. Unsuspecting users who downloaded and executed the fake MSTeamsSetup.exe files inadvertently installed a multi-stage payload. The initial loader deployed the Oyster backdoor, a versatile malware tool that Vanilla Tempest has used since June 2025. Once installed, Oyster provided the attackers with remote access, enabling them to steal files, execute arbitrary commands, and deploy additional malicious payloads. The campaign’s technical sophistication was heightened by the use of certificates from reputable providers like Trusted Signing, SSL.com, DigiCert, and GlobalSign, which were fraudulently used to sign the malware. Microsoft’s response involved revoking all compromised certificates, effectively neutralizing the attackers’ ability to distribute signed malware and disrupting ongoing infections. The group’s primary objective was financial gain through data exfiltration and ransomware deployment, with Rhysida ransomware being their recent tool of choice. Previous campaigns by Vanilla Tempest have also used ransomware strains such as BlackCat, Quantum Locker, and Zeppelin, but the current focus has been on Rhysida, particularly targeting sectors like healthcare, education, and manufacturing. The attackers’ use of malvertising and SEO poisoning demonstrates an evolving threat landscape where legitimate-looking software is weaponized to bypass traditional defenses. Microsoft’s intervention not only halted the immediate threat but also highlighted the importance of certificate management and vigilance against supply chain attacks. Security researchers emphasized the need for organizations to verify software sources and monitor for unusual certificate usage. The incident underscores the persistent risk posed by financially motivated ransomware groups and the necessity for coordinated industry responses to disrupt their operations. Organizations are advised to educate users about the dangers of downloading software from unofficial sources and to implement robust endpoint protection measures. The campaign’s exposure and Microsoft’s swift action serve as a warning to both defenders and attackers about the critical role of digital trust in modern cyber operations. This event also illustrates the increasing use of backdoors like Oyster in ransomware campaigns, enabling deeper and more persistent access to victim networks. The disruption of this campaign is a significant blow to Vanilla Tempest’s operations and a reminder of the ongoing arms race between threat actors and defenders.
Jun 29, 2026
Microsoft Defender Experts tracked a deceptive software-download campaign using counterfeit vendor websites and dynamically generated malicious installer archives to compromise victims. The activity primarily targeted China-based operations of multinational organizations and Chinese-speaking users in healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assessed with moderate confidence that the operation is consistent with the publicly reported **Silver Fox** (also known as **Yinhu**) threat activity, while stopping short of nation-state attribution. The malware established persistence through scheduled tasks, abused `msiexec` and a repurposed TrueUpdate runtime, weakened Microsoft Defender and Windows Update protections, deleted shadow copies, injected into processes, and communicated with attacker infrastructure through non-standard ports and Alibaba Cloud OSS. Microsoft Defender detected and disrupted elements of the operation, including command-and-control traffic, attempted SMB lateral movement, and hands-on-keyboard activity; however, incident responders still needed to remove the attackers' persistence mechanisms.
Sep 4, 2026
Microsoft, Europol, law enforcement agencies, and multiple private-sector partners carried out a coordinated disruption of the **StealC** infostealer and **Amadey** loader ecosystems, using court orders and related legal actions to target both malware operations at once. The operation struck a broad criminal infrastructure spanning more than 200 command-and-control domains and IP addresses, with partner reporting citing **66 domains** and **296 servers** tied to the two services. Microsoft said the malware families were linked to more than **140,000 infected computers** in a single week in May, while partner investigators reported the seizure of **25.6 million unique credentials** stolen from more than **385,000 compromised systems**. Investigators said **StealC**, active since 2023 as a malware-as-a-service infostealer, was used to steal browser data, credentials, email and messaging data, VPN and cloud access, and cryptocurrency wallet information, while **Amadey**, active since 2018, functioned as a modular loader and backdoor that frequently delivered StealC and other payloads. Researchers also identified a vulnerability in the StealC command-and-control panel that helped support search-and-seizure actions, and they used configuration extraction and a custom emulator to map affiliate activity and delivery chains. The two malware families were described as part of a broader cybercrime ecosystem tied to credential theft, access brokering, and downstream attacks including ransomware, with observed links to payloads such as **AsyncRAT**, **RedLine**, **Vidar**, **XMRig**, and in one case **LockBit Black**.
Aug 11, 2026