Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks

Microsoft disrupted a malware-signing-as-a-service (MSaaS) operation called Fox Tempest that abused Artifact Signing to distribute signed malware and conduct ransomware attacks affecting thousands of machines worldwide.

• •Fox Tempest used fraudulently obtained code-signing certificates valid for 72 hours to make malware appear as legitimate software like Microsoft Teams, AnyDesk, and PuTTY
• •The malware-signing service cost between $5,000 and $9,000, enabling threat actors to deploy ransomware families including Rhysida, and connect to other major ransomware operations like INC, Qilin, BlackByte, and Akira
• •Fox Tempest obtained fraudulent certificates by using stolen identities from the United States and Canada to pass Microsoft's identity verification processes
• •The operation evolved to use pre-configured virtual machines hosted on Cloudzy for direct file signing and delivery starting February 2026