TLDR Tech / InfoSec
Microsoft disrupts malware code-signing service used by ransomware gangs
Microsoft disrupted Fox Tempest's malware-signing-as-a-service (MSaaS) operation by seizing signspace[.]cloud, revoking 1,000+ code-signing certificates obtained via stolen identities and abused Azure Artifact Signing subscriptions, and taking offline hundreds of attacker-controlled VMs, with cybercriminals paying $5,000–$9,000 per deployment to bypass SmartScreen warnings and evade detection. Vanilla Tempest and affiliates of INC, Qilin, Akira, and Rhysida used signed fake installers (AnyDesk, Teams, PuTTY, and Webex) distributed through SEO poisoning and malvertising to deploy backdoors, infostealers, and ransomware. The shift reflects cybercrime's modularization: specialized high-friction services like code-signing are now commoditized and sold interchangeably, replacing monolithic attack chains and enabling rapid scaling across ransomware campaigns since at least May 2025.
Read the full story