Microsoft shuts down illegal code-signing operation used by ransomware crims to mask their malware

"Microsoft seized websites and took down hundreds of virtual machines running a cybercrime service that allegedly sold code-signing certificates to ransomware gangs, thus making their malware look like legitimate software - and allowing criminals to infect thousands of machines in the US, including at least 12 owned and operated by the Windows giant."

"The malware signing-as-a-service operation called Fox Tempest has been around since May 2025, and abuses Microsoft's Artifact Signing code-signing service. This service allows developers to digitally sign their software applications, signaling to the Windows operating system and end-user that the software is authentic, and hasn't been tampered with."

"Since May 2025, the Fox Tempest crew - referred to as John Doe 1 and 2 in court documents unsealed on Tuesday - used fake identities and impersonated real organizations, allowing them to create more than 580 fraudulent Microsoft accounts. They then used these accounts to abuse Microsoft's Artifact Signing service and obtain real code-signing credentials, then sold the code-signing certificates to other criminals for thousands of dollars."

"According to Microsoft, Fox Tempest's customers included a ransomware group Redmond tracks as Vanilla Tempest (aka Vice Spider, Vice Society, Rhysida), which allegedly used the certificates to digitally sign malware and make it appear legitimate to Windows and users. This also allowed the ransomware slingers "to more easily deploy the malware onto the computers of unsuspecting victims without their consent," according to the court documents [PDF]."

Microsoft seized websites and took down hundreds of virtual machines running a cybercrime service that allegedly sold code-signing certificates to ransomware gangs. The service, called Fox Tempest, abused Microsoft’s Artifact Signing code-signing service to obtain real signing credentials. Developers normally use code signing to signal software authenticity and lack of tampering to Windows and end users. Since May 2025, Fox Tempest used fake identities and impersonated real organizations to create more than 580 fraudulent Microsoft accounts. It then used those accounts to abuse Artifact Signing and sell certificates for thousands of dollars. Microsoft reported customers included Vanilla Tempest, which used the certificates to digitally sign malware and deploy it more easily to unsuspecting victims. Malware included Oyster backdoor, Lumma and Vidar infostealers, and Rhysida ransomware.

Read at theregister