Microsoft-Signed Malware Built With FUD Crypt Packs Persistence and C2

The report describes FUD Crypt, a commercial Malware‑as‑a‑Service that uses Azure Trusted Signing to produce Microsoft‑chained Authenticode binaries which evade detection, establish persistence (Run key and scheduled task), bypass AMSI/ETW and UAC, and connect to a WebSocket C2 (mstelemetrycloud.com). Investigators observed active deployments (32 agents, many with admin privileges) and thousands of issued commands; the platform includes per‑build AV tuning, DLL sideloading into legitimate apps, and features to disable Defender and deploy remote access tools, making it a high‑risk, highly evasive malware distribution service.