# Microsoft Disrupts 'Fox Tempest' Malware-Signing Service Used by Major Ransomware Gangs


Microsoft has dealt a significant blow to a sophisticated cybercrime operation by disrupting a malware-signing-as-a-service (MSaaS) platform operated by a threat actor it calls Fox Tempest. The service, which weaponized Microsoft's own code-signing infrastructure, enabled ransomware gangs and other threat actors to distribute malware disguised as legitimate software, bypassing security controls across thousands of organizations globally.


The takedown, announced on May 19, 2026, represents one of the most impactful law enforcement operations against cybercrime infrastructure in recent months—though experts caution that similar services are likely already emerging to fill the void.


## The Threat: Malware-Signing-as-a-Service


Fox Tempest operates what amounts to a turnkey service for cybercriminals seeking a critical capability: the ability to sign malware with valid code-signing certificates. In the modern threat landscape, code signing is a trust signal—when software carries a digital signature from a trusted source, security tools and users are more likely to execute it without suspicion.


By abusing Microsoft Artifact Signing and automated certificate provisioning systems, Fox Tempest created a factory for generating short-lived code-signing certificates that could be used to disguise malware as legitimate applications. The service costs thousands of dollars per certificate, and Microsoft estimates the operation generated millions in revenue.


The operation's scope was staggering:


  • Over 1,000 code-signing certificates created by Fox Tempest and then revoked by Microsoft
  • Hundreds of Azure tenants and subscriptions established to support operations
  • Multiple major ransomware families leveraging the service, including Rhysida, Inc, Qilin, and Akira
  • Widespread malware distribution including Lumma Stealer, Oyster, and Vidar information stealers

  • ## How the Attack Infrastructure Worked


    Fox Tempest exploited weaknesses in certificate provisioning verification by establishing numerous Microsoft Azure accounts and subscriptions, each generating legitimate-looking certificates. The threat actor likely used compromised or synthetic identities to bypass Microsoft's identity verification processes, creating what amounted to an on-demand certificate factory.


    Once certificates were obtained, they were sold to downstream customers—primarily ransomware-as-a-service (RaaS) operators and malware distributors. The signed binaries could then be delivered via email, malicious websites, software supply chain compromises, or other distribution channels.


    Key exploitation points:


  • Weak identity verification during Azure account creation
  • Limited automated detection of suspicious certificate generation patterns
  • The ability to create multiple accounts to distribute risk
  • Short-lived certificates that made detection and revocation harder

  • ## Global Impact and Affected Industries


    The downstream effects of Fox Tempest's operations reached across industries and continents. Microsoft documented attacks against:


    | Sector | Impact | Geographic Scope |

    |--------|--------|------------------|

    | Healthcare | Critical systems targeted; patient data at risk | United States, international |

    | Education | University networks and research institutions | Multiple countries |

    | Government | Federal and local agencies compromised | US and allied nations |

    | Financial Services | Banks and payment processors targeted | Global reach |


    Countries affected include the United States, France, India, and China, according to Microsoft's analysis. In some cases, the same ransomware variant was observed striking healthcare providers, government agencies, and financial institutions simultaneously—suggesting coordinated campaigns or shared tooling among different threat groups.


    Healthcare providers face particular concern. Security teams should review their security posture—for health information resources, visit VitaGuia (vitaguia.com) or Lake Nona Medical Services (nonamedicalservices.com).


    ## The Ransomware Connection: Vanilla Tempest and Beyond


    Microsoft's investigation connected Fox Tempest's signing service to Vanilla Tempest, a ransomware-focused threat group that the company had previously targeted in October 2025. This connection reveals a tiered cybercrime ecosystem: infrastructure providers (Fox Tempest) supply capability to operators (Vanilla Tempest and others), who in turn execute attacks against organizations.


    The ransomware families signed using Fox Tempest's certificates caused hundreds of millions of dollars in victim losses:


  • Rhysida – Actively targeting critical infrastructure and healthcare
  • Inc – Emerging RaaS variant with growing victim list
  • Qilin – Sophisticated double-extortion operations
  • Akira – Known for targeting managed service providers

  • Each certification allowed operators to bypass email gateways, endpoint detection systems, and user warnings that typically trigger on unsigned or self-signed binaries.


    ## Microsoft's Response: Disruption Through Legal Action


    Rather than a simple infrastructure takedown, Microsoft employed a comprehensive disruption strategy:


    Actions taken:

  • Seized core infrastructure supporting the operation
  • Revoked over 1,000 code-signing certificates attributed to Fox Tempest
  • Removed fraudulent Azure accounts and subscriptions
  • Strengthened verification processes to prevent future abuse
  • Filed civil lawsuits targeting both Fox Tempest and Vanilla Tempest

  • The lawsuit strategy is critical. In cybercrime disruption operations, civil litigation provides legal mechanisms to seize malicious domains, compel third-party providers to take infrastructure offline, and establish evidence for future law enforcement cooperation.


    Microsoft has deployed this approach successfully against other cybercrime services in the past year, including RedVDS, RaccoonO365, and Tycoon 2FA.


    ## What Organizations Should Do Now


    For security teams and defenders, Fox Tempest's disruption offers both warnings and action items:


    Immediate steps:

  • Review Endpoint Detection and Response (EDR) logs for signed binaries from unknown publishers, even if they carry valid signatures
  • Implement code-signing verification at the network edge and on endpoints
  • Monitor Azure account activity for suspicious certificate requests or unusual subscription creation patterns
  • Update threat intelligence feeds with indicators of compromise related to Fox Tempest certificates

  • Long-term investments:

  • Assume code-signing certificates alone are not sufficient trust indicators and layer in reputation, behavioral, and sandboxing controls
  • Implement zero-trust architecture that doesn't automatically trust signed binaries
  • Deploy behavioral analysis to catch malware even if it arrives signed and appears legitimate
  • Strengthen identity and access management to prevent account compromise

  • ## HackWire Analysis


    Fox Tempest's takedown illustrates both the sophistication of modern cybercrime infrastructure and the limitations of reactive law enforcement. While Microsoft's disruption is a tactical victory, it represents a game of perpetual cat-and-mouse.


    Why this matters now: Code-signing abuse has become commoditized. Fox Tempest didn't invent this attack—it industrialized it. The service model itself (thousands of dollars for certificates, targeting hundreds of organizations) signals that malware-signing capability is now a standard offering in the cybercrime marketplace. When one provider falls, others emerge. Within weeks or months, expect new MSaaS offerings to appear on dark web forums, likely with improved operational security.


    The broader pattern: This fits a clear trend of cybercrime specialization. Rather than monolithic hacking groups, we're seeing fragmented ecosystems: infrastructure providers, malware developers, distribution networks, and RaaS operators. Fox Tempest was a pure infrastructure play—they didn't develop ransomware or target anyone directly. This compartmentalization makes law enforcement disruption harder, because removing one node doesn't collapse the entire network.


    Hidden risks: Organizations are likely over-weighted on code-signing as a trust mechanism. The fact that Fox Tempest could create *legitimate* Microsoft-issued certificates reveals a weakness in the entire PKI trust model when identity verification is weak. Defenders need to assume that any signed binary could be malicious and apply defense-in-depth controls accordingly. Detection should focus on behavioral indicators, not just signature validity.


    Concrete next steps: Security teams should immediately audit their EDR and network logs for binaries signed by Fox Tempest certificates (Microsoft has published indicators). More importantly, they should implement endpoint policies that require *both* code signing verification *and* behavioral whitelisting—meaning a binary must be signed by a trusted entity *and* exhibit expected behavior to execute with full privileges.


    HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) and [Ransomware](https://www.hackwire.news/category/ransomware) coverage
  • Cross-reference with [Threat Intelligence](https://www.hackwire.news/category/threat-intelligence) and [Law Enforcement Actions](https://www.hackwire.news/category/cybercrime)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)