The Fox Tempest Question

This report details a sophisticated malware-signing campaign that routes a matched build lineage through two separate code-signing trust chains—a Certum corporate shell certificate for a loader and a Microsoft Trusted Signing individual certificate for an information stealer—enabling a Telegram-based reverse shell, client-side device fingerprinting via idantre.com, aggressive persistence via a 1-minute scheduled task, and operational resilience through MSaaS-sourced certificates (Fox Tempest) potentially linked to Dragon Breath/APT-Q-27.