fox tempest

Executive Summary

Fox Tempest operates a lucrative malware‑signing‑as‑a‑service (MSaaS) that issues short‑lived counterfeit Microsoft Artifact Signing certificates, enabling ransomware gangs to sign binaries and evade defenders. The service has driven large‑scale distribution of signed ransomware such as Rhysida and Vidar, targeting critical sectors worldwide. Recent takedowns in 2026 disrupted the provider’s website and cloud infrastructure but did not eliminate its impact.

Goals & Targeting

The actor aims to maximize financial gain by monetizing access to high‑trust certificates and cloud infrastructure. By supplying signed binaries that trick defenders, Fox Tempest enables widespread ransomware outbreaks that target high‑profile institutions—healthcare providers, educational establishments, government agencies, large enterprises, and critical utilities—to extract larger ransoms. Their focus on multi‑sector, multinational victims reflects a strategy of broad market penetration rather than narrow ideological objectives.

Key Capabilities

• Generate short‑lived fraudulent Microsoft Artifact Signing certificates
• Operate a malware‑signing‑as‑a‑service platform that issues compromised certificates and pre‑configured VMs
• Create and manage Azure tenants/subscriptions to support malicious infrastructure
• Provide digitally signed binaries for ransomware delivery
• Offer a payment model via Google Form ($5k–$9k tiers)
• Provision virtual machines and access to signing infrastructure on third‑party cloud services
• Communicate with clients through a Telegram channel
• Distribute signed malware via legitimate ad campaigns, malvertising, and SEO manipulation
• Employ AI to generate campaign content
• Quickly switch code‑signing providers after takedowns

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Fox Tempest’s MSaaS has fueled a wave of signed‑binary ransomware campaigns across the globe since at least 2025. High‑profile operations—such as the distribution of signed Microsoft Teams installers that carried the Oyster backdoor and deployed Rhysida ransomware in hospitals and educational institutions—highlight a preference for fast, high‑impact attacks against systems where digital signatures are strongly trusted. The actor operates with an accelerated tempo: issuing thousands of certificates and hundreds of Azure tenants per month, scaling operations by leasing third‑party virtual machines when its primary signing sources are shut down. Victim selections span public sector, healthcare, education, finance, defense, and critical infrastructure, reflecting a broad threat profile aimed at maximizing financial return.

IOC Patterns

• Fraudulent Microsoft Artifact Signing certificate
• Short‑lived (72 hour) code‑signing certificate
• Azure tenant/subscription misuse for malicious activity
• Malicious signed binary masquerading as legitimate software
• Cloud‑hosted virtual machine used to deliver signed malware
• Signed .exe files masquerading as Microsoft Teams installers
• Code‑signing certificates linked to Fox Tempest email accounts
• Malicious MSTeamsSetup.exe downloads
• Telegram-based client communication links
• Google Form payment portal with tiered pricing
• Signspace.cloud domain
• Malvertising domains and SEO poisoning sites

Recommended Actions

• Block or filter traffic to known compromised code‑signing services such as signspace.cloud.
• Verify authenticity of all code signatures, particularly short‑lived certificates.
• Implement continuous monitoring for new Azure tenant/subscription creation and suspicious usage patterns.
• Detect and block malvertising and SEO poisoning channels that distribute signed malware.
• Cooperate with cloud providers to identify and shut down malicious VMs used by Fox Tempest.
• Revoke or blacklist fraudulent code‑signing certificates issued by the actor.
• Enforce publisher allowlists, permitting only trusted binaries in controlled environments.
• Employ behavior‑based detection for suspicious but signed executables.
• Filter download traffic for Microsoft Teams installer URLs and cross‑validate signatures against official releases.
• Educate users about phishing forms on public Google Forms and Telegram vendor communications.
• Deploy certificate revocation lists (CRLs) and monitor certificate transparency logs for misuse.
• Ensure layered security that does not rely solely on digital signature trust.
• Maintain up‑to‑date malware detection rules that flag known families such as Rhysida, Vidar, Oyster, and Lumma Stealer.