Fox Tempest Malware-Signing Service Disruption

Microsoft Threat Intelligence has identified and disrupted Fox Tempest, a financially motivated threat actor providing malware-signing-as-a-service (MSaaS). The group specialized in abusing Microsoft Artifact Signing to obtain legitimate, short-lived (72-hour) digital certificates using stolen identities. These certificates allowed malicious payloads, including ransomware and infostealers, to appear as trusted software from vendors like Microsoft and AnyDesk, effectively bypassing security reputation checks.

Fox Tempest supported high-profile ransomware affiliates including Vanilla Tempest, Storm-0501, and Storm-0249, facilitating the deployment of Rhysida, INC, Qilin, and Akira ransomware. Their infrastructure evolved from a web-based portal at signspace[.]cloud to providing pre-configured virtual machines on Cloudzy infrastructure where customers could upload files for automated signing. The service was priced between $5,000 and $9,000 USD, highlighting the professionalization of the cybercrime supply chain.

The global impact of Fox Tempest's operations spans sectors such as healthcare, education, and government. By lowering the barrier for malware execution through trusted signatures, the group served as a critical enabler for various criminal campaigns. Ongoing collaboration between Microsoft and industry partners has led to the revocation of over 1,000 fraudulent certificates and the disruption of key backend infrastructure.