Microsoft Dismantles “Fox Tempest” Code-Signing Network Fueling Global Ransomware

Microsoft and partner Resecurity disrupted 'Fox Tempest', a criminal operation offering malware-signing-as-a-service by abusing Microsoft Artifact Signing to create 72-hour fraudulent code-signing certificates; these signed binaries enabled distribution of malware (including Oyster, Lumma, Vidar) and deployment of Rhysida ransomware across multiple sectors before Microsoft revoked over a thousand fraudulent certificates and disabled core infrastructure.